Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe

Overview

General Information

Sample URL:https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe
Analysis ID:672930
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Changes security center settings (notifications, updates, antivirus, firewall)
Obfuscated command line found
Creates an undocumented autostart registry key
Creates files inside the driver directory
Queries the volume information (name, serial number etc) of a device
Drops certificate files (DER)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Found evasive API chain checking for process token information
Contains functionality to launch a program with higher privileges
Binary contains a suspicious time stamp
Enables security privileges
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates or modifies windows services
Queries disk information (often used to detect virtual machines)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe" > cmdline.out 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
    • conhost.exe (PID: 1068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • wget.exe (PID: 6052 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • MSDisplay_Windows_V2.0.1.7.3.exe (PID: 4448 cmdline: "C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe" MD5: 44B238973B55B2D863BC8608140AF84D)
    • MSDisplay_Windows_V2.0.1.7.3.tmp (PID: 5384 cmdline: "C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe" MD5: 3656DEEFA846EB33067D66B624232474)
      • devcon.exe (PID: 1004 cmdline: "C:\Program Files\USM USB Display\tool\x64\devcon.exe" dp_add "C:\Program Files\USM USB Display\lib_usb\MSUSBDisplay.inf" USB\VID_534D&PID_6021&MI_03 MD5: 8C7D36AD908F5F1A5E39F95AC92581F5)
        • conhost.exe (PID: 3740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • devcon.exe (PID: 5392 cmdline: "C:\Program Files\USM USB Display\tool\x64\devcon.exe" install "C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.inf" root\IndirectDisplayBus MD5: 8C7D36AD908F5F1A5E39F95AC92581F5)
        • conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 2920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5256 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4608 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5620 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5504 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4412 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 784 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 3196 cmdline: C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5456 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 5872 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 2552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 3964 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 2944 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4732 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • WinUsbDisplay.exe (PID: 2896 cmdline: "C:\Program Files\USM USB Display\WinUsbDisplay.exe" MD5: F70F3B35A5543365775F3EBD2C541F3E)
  • svchost.exe (PID: 6140 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s DeviceInstall MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • drvinst.exe (PID: 3908 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.inf" "9" "42202a2d7" "00000000000001A8" "WinSta0\Default" "00000000000001AC" "208" "C:\Program Files\USM USB Display\lib_usb" MD5: 46F5A16FA391AB6EA97C602B4D2E7819)
    • drvinst.exe (PID: 5004 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus" MD5: 46F5A16FA391AB6EA97C602B4D2E7819)
  • svchost.exe (PID: 3584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • WinUsbDisplay.exe (PID: 4980 cmdline: "C:\Program Files\USM USB Display\WinUsbDisplay.exe" MD5: F70F3B35A5543365775F3EBD2C541F3E)
  • svchost.exe (PID: 6080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1Jump to behavior
Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB DisplayJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\unins000.datJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-D8A40.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-0UQ04.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-MOJ63.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-R9A24.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-2I15K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-A6KB9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-OMQCP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-A2VEK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-IA2R2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-JCE9I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\toolJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\arm64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\arm64\is-VAK36.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64\is-DMNPK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64\is-JRJP3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86\is-MKN2N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86\is-0A4G1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driverJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\is-9I04T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\is-33D8F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64\is-DG52H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64\is-PCJE3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86\is-0RNM6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86\is-H235T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxyJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\is-9MJOO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\is-AH2C4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\is-E9T21.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\is-BOERA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64\is-JMA70.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64\is-6A73L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86\is-KH3U6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86\is-SNPR6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\iddJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybusJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-DEC5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-PA7MG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\is-GIP3E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\is-3EUOE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-1FC6M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-00D84.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\is-V2FIH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\is-EOKMR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-GQLTN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-9U9M8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\is-PDP06.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\is-G5BU5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-72IH6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-CU32L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\is-GHBL6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\is-75BQ3.tmpJump to behavior
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeDirectory created: C:\Program Files\USM USB Display\vMonitorlog.logJump to behavior
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\unimp\miniport\objfre_w2k_x86\i386\dfmirage.pdb source: is-H235T.tmp.7.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyUmd.pdb source: is-JB1P2.tmp.7.dr, is-7VVLQ.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver0\Release\indirectdisplaydriver0.pdb source: is-EOKMR.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\mirage\mirage~1\objfre_w2k_x86\i386\dfmirage.pdb source: is-0RNM6.tmp.7.dr
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr
Source: Binary string: D:\Work\Project\MS7130\Windows\USBTest\USM\windows-adapter-display-multidev\Release\WinUsbDisplay.pdb source: WinUsbDisplay.exe, 00000017.00000000.344064822.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 00000017.00000002.511764877.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361144483.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000002.386853198.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver2\x64\Release\IndirectDisplayDriver2.pdb source: is-GHBL6.tmp.7.dr
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, is-SNPR6.tmp.7.dr, SET1884.tmp.21.dr, SET34A8.tmp.25.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyUmd.pdbGCTL source: is-JB1P2.tmp.7.dr, is-7VVLQ.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayBus\Win32\Release\IndirectDisplayBus.pdb source: is-3EUOE.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver0\x64\Release\indirectdisplaydriver0.pdb source: is-V2FIH.tmp.7.dr
Source: Binary string: DpInst.pdb source: is-0A4G1.tmp.7.dr
Source: Binary string: devcon.pdb source: devcon.exe, 00000015.00000002.426309180.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 00000015.00000000.324270292.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 0000001F.00000000.427511561.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, is-MKN2N.tmp.7.dr
Source: Binary string: DpInst.pdbp source: is-0A4G1.tmp.7.dr
Source: Binary string: devcon.pdbGCTL source: devcon.exe, 00000015.00000002.426309180.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 00000015.00000000.324270292.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 0000001F.00000000.427511561.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, is-MKN2N.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\unimp\miniport\objfre_wnet_amd64\amd64\dfmirage.pdb source: is-PCJE3.tmp.7.dr
Source: Binary string: msvcr120.i386.pdb source: WinUsbDisplay.exe, 00000017.00000002.518142818.000000006C521000.00000020.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver1\x64\Release\IndirectDisplayDriver1.pdb source: is-PDP06.tmp.7.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\libVMonitor.pdb source: WinUsbDisplay.exe, 00000017.00000002.520613004.000000006F6DD000.00000002.00000001.01000000.0000000C.sdmp, WinUsbDisplay.exe, 0000001B.00000002.387616683.000000006F6DD000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyKmd.pdb source: is-AI2CQ.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\mirage\mirage~1\objfre_wnet_amd64\amd64\dfmirage.pdb source: is-DG52H.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayBus\x64\Release\IndirectDisplayBus.pdb source: drvinst.exe, 00000026.00000003.499328459.000001EC3B0DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Work\Project\MS7130\Windows\USBTest\USM\windows-adapter-display-multidev\Release\WinUsbDisplay.pdb{ source: WinUsbDisplay.exe, 00000017.00000000.344064822.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 00000017.00000002.511764877.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361144483.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000002.386853198.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.dr
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0040AEF4 FindFirstFileW,FindClose,6_2_0040AEF4
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,6_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0060C2B0 FindFirstFileW,GetLastError,7_2_0060C2B0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0040E6A0 FindFirstFileW,FindClose,7_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,7_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_006B8DE4 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,7_2_006B8DE4
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: svchost.exe, 0000001D.00000003.426865644.000001DF54571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001D.00000003.426865644.000001DF54571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001D.00000003.425698297.000001DF54581000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.426865644.000001DF54571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001D.00000003.425698297.000001DF54581000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.426865644.000001DF54571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://crl.globalsign.com/gs/gscodesigng3.crl0
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://crl.globalsign.com/root.crl0Y
Source: wget.exe, 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.512349157.00000280BDE63000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000002.415430231.000002C5BE34B000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.411660506.000002C5BE34B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.466527482.000001DF54500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000014.00000002.512349157.00000280BDE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.466357188.000001DF53AEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-SNPR6.tmp.7.dr, SET1884.tmp.21.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr, SET34A8.tmp.25.drString found in binary or memory: http://libusb-win32.sourceforge.netN
Source: devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, is-6A73L.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.drString found in binary or memory: http://libusb-win32.sourceforge.netb
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesigng30V
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: svchost.exe, 0000001D.00000002.466319104.000001DF53AD6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.microft8
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng3ocsp.crt04
Source: is-DG52H.tmp.7.dr, is-0RNM6.tmp.7.dr, is-PCJE3.tmp.7.dr, is-H235T.tmp.7.dr, is-MKN2N.tmp.7.dr, is-0A4G1.tmp.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, is-JB1P2.tmp.7.dr, is-SNPR6.tmp.7.dr, is-DG52H.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-0RNM6.tmp.7.dr, SET1884.tmp.21.dr, is-PCJE3.tmp.7.dr, is-9MJOO.tmp.7.dr, is-H235T.tmp.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: svchost.exe, 0000000E.00000002.313481344.000001EE00013000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
Source: WinUsbDisplay.exe, 00000017.00000002.511919631.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361184983.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.drString found in binary or memory: http://www.tightvnc.com/?f=sa&Timed
Source: WinUsbDisplay.exe, 00000017.00000002.511919631.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361184983.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.drString found in binary or memory: http://www.tightvnc.com/licensing/?f=sa
Source: svchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313256656.000001EE00047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000003.313230524.000001EE00041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313533369.000001EE00042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000003.313230524.000001EE00041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313533369.000001EE00042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.313204204.000001EE00057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.313204204.000001EE00057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: wget.exe, wget.exe, 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.
Source: wget.exe, 00000002.00000002.236027790.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe
Source: wget.exe, 00000002.00000002.236027790.00000000012E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe).
Source: MSDisplay_Windows_V2.0.1.7.3.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000000.242239784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe.2.drString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: cmdline.out.0.drString found in binary or memory: https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe
Source: svchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.313481344.000001EE00013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313242152.000001EE0003A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313256656.000001EE00047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: is-AI2CQ.tmp.7.dr, SET34A8.tmp.25.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: svchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.hotspotshield.com/terms/
Source: MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243534503.000000007FBA0000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243100248.0000000002550000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp, MSDisplay_Windows_V2.0.1.7.3.tmp, 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp.6.dr, is-D8A40.tmp.7.drString found in binary or memory: https://www.innosetup.com/
Source: svchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pango.co/privacy
Source: MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243534503.000000007FBA0000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243100248.0000000002550000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp, MSDisplay_Windows_V2.0.1.7.3.tmp, 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp.6.dr, is-D8A40.tmp.7.drString found in binary or memory: https://www.remobjects.com/ps
Source: svchost.exe, 0000001D.00000003.445444368.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.445494511.000001DF5459E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
Source: unknownDNS traffic detected: queries for: github.com
Source: global trafficHTTP traffic detected: GET /MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: github.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: raw.githubusercontent.comConnection: Keep-Alive
Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknownHTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\IndirectDisplayBus.cat (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-DEC5C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\indirectdisplaydriver1.cat (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\SET143D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\dfmirage.cat (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.cat (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.cat (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\SET1FD0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\IndirectDisplayDriver0.cat (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\SET2FC4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\displayproxy.cat (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-GQLTN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-1FC6M.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-72IH6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\is-E9T21.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\is-9MJOO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\msusbdisplay.cat (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\SET351D.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\is-9I04T.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\IndirectDisplayBus.cat (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\MSUSBDisplay.cat (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\indirectdisplaydriver2.cat (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}Jump to behavior
Source: C:\Windows\System32\drvinst.exeFile deleted: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2BDA.tmpJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,6_2_004AF110
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0060F6D8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,7_2_0060F6D8
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAC9692_2_00CAC969
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB7EA42_2_00CB7EA4
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004323DC6_2_004323DC
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004255DC6_2_004255DC
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0040E9C46_2_0040E9C4
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_006B786C7_2_006B786C
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0040C9387_2_0040C938
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 0060CD28 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 005F5C7C appears 50 times
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 005F5F60 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 005DE888 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 006163B4 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: String function: 00616130 appears 39 times
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-D8A40.tmp.7.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: MSDisplay_Windows_V2.0.1.7.3.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.exe.2.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JRJP3.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JRJP3.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JRJP3.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JRJP3.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JRJP3.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-D8A40.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-D8A40.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-D8A40.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-D8A40.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0UQ04.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0A4G1.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0A4G1.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0A4G1.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0A4G1.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-0A4G1.tmp.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dllJump to behavior
Source: C:\Windows\System32\svchost.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe"
Source: unknownProcess created: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe "C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe"
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp "C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess created: C:\Program Files\USM USB Display\tool\x64\devcon.exe "C:\Program Files\USM USB Display\tool\x64\devcon.exe" dp_add "C:\Program Files\USM USB Display\lib_usb\MSUSBDisplay.inf" USB\VID_534D&PID_6021&MI_03
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Program Files\USM USB Display\WinUsbDisplay.exe "C:\Program Files\USM USB Display\WinUsbDisplay.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k dcomlaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.inf" "9" "42202a2d7" "00000000000001A8" "WinSta0\Default" "00000000000001AC" "208" "C:\Program Files\USM USB Display\lib_usb"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknownProcess created: C:\Program Files\USM USB Display\WinUsbDisplay.exe "C:\Program Files\USM USB Display\WinUsbDisplay.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess created: C:\Program Files\USM USB Display\tool\x64\devcon.exe "C:\Program Files\USM USB Display\tool\x64\devcon.exe" install "C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.inf" root\IndirectDisplayBus
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe" Jump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp "C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess created: C:\Program Files\USM USB Display\tool\x64\devcon.exe "C:\Program Files\USM USB Display\tool\x64\devcon.exe" dp_add "C:\Program Files\USM USB Display\lib_usb\MSUSBDisplay.inf" USB\VID_534D&PID_6021&MI_03Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess created: C:\Program Files\USM USB Display\tool\x64\devcon.exe "C:\Program Files\USM USB Display\tool\x64\devcon.exe" install "C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.inf" root\IndirectDisplayBusJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.inf" "9" "42202a2d7" "00000000000001A8" "WinSta0\Default" "00000000000001AC" "208" "C:\Program Files\USM USB Display\lib_usb"Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: USM USB Display.lnk.7.drLNK file: ..\..\..\..\..\..\Program Files\USM USB Display\WinUsbDisplay.exe
Source: Uninstall USM USB Display.lnk.7.drLNK file: ..\..\..\..\..\..\Program Files\USM USB Display\unins000.exe
Source: USM USB Display.lnk0.7.drLNK file: ..\..\..\..\..\..\..\Program Files\USM USB Display\WinUsbDisplay.exe
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,6_2_004AF110
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0060F6D8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,7_2_0060F6D8
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeFile created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmpJump to behavior
Source: is-AI2CQ.tmp.7.drBinary string: dlkmd.sysVSyncIntervalMsVSyncBlankPeriodMsdxgkrnl.sysBootStatus\Device\DxgKrnl\Registry\Machine\System\CurrentControlSet\Services\DXGKrnldlkmd.sys\Driver\BasicRenderDisplayProxyUmd.dllDisplayProxyUmd.dllDisplayProxyUmd.dllDisplayProxyUmd.dllDisplayProxyUmd32.dllDisplayProxyUmd32.dllDisplayProxyUmd32.dllDisplayProxyUmd32.dllUserModeDriverNameUserModeDriverNameWowdwm.exenvvsvc.exeRtlQueryModuleInformation
Source: SET2D71.tmp.25.drBinary string: \Device\libusb0%s%04d
Source: classification engineClassification label: mal52.evad.win@37/149@2/4
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0062CFB8 GetVersion,CoCreateInstance,7_2_0062CFB8
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile read: C:\Program Files\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0041A4DC GetDiskFreeSpaceW,6_2_0041A4DC
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1068:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3740:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2552:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_01
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WinUsbDisplayApplication
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004AF9F0 FindResourceW,SizeofResource,LoadResource,LockResource,6_2_004AF9F0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB DisplayJump to behavior
Source: MSDisplay_Windows_V2.0.1.7.3.exeString found in binary or memory: Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file af
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: C:\Windows\SysWOW64\wget.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\wget.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpAutomated click: Next
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB DisplayJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\unins000.datJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-D8A40.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-0UQ04.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-MOJ63.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-R9A24.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-2I15K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-A6KB9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-OMQCP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-A2VEK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-IA2R2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\is-JCE9I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\toolJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\arm64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\arm64\is-VAK36.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64\is-DMNPK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x64\is-JRJP3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86\is-MKN2N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\tool\x86\is-0A4G1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driverJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\is-9I04T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\is-33D8F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64\is-DG52H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x64\is-PCJE3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86\is-0RNM6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\video_driver\x86\is-H235T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxyJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\is-9MJOO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\is-AH2C4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\is-E9T21.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\is-BOERA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64\is-JMA70.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\amd64\is-6A73L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86\is-KH3U6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\lib_usb\x86\is-SNPR6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\iddJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybusJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-DEC5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-PA7MG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\is-GIP3E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\is-3EUOE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-1FC6M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-00D84.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\is-V2FIH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\is-EOKMR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-GQLTN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-9U9M8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\is-PDP06.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\is-G5BU5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-72IH6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-CU32L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\is-GHBL6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDirectory created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\is-75BQ3.tmpJump to behavior
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeDirectory created: C:\Program Files\USM USB Display\vMonitorlog.logJump to behavior
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\unimp\miniport\objfre_w2k_x86\i386\dfmirage.pdb source: is-H235T.tmp.7.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyUmd.pdb source: is-JB1P2.tmp.7.dr, is-7VVLQ.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver0\Release\indirectdisplaydriver0.pdb source: is-EOKMR.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\mirage\mirage~1\objfre_w2k_x86\i386\dfmirage.pdb source: is-0RNM6.tmp.7.dr
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-6A73L.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr
Source: Binary string: D:\Work\Project\MS7130\Windows\USBTest\USM\windows-adapter-display-multidev\Release\WinUsbDisplay.pdb source: WinUsbDisplay.exe, 00000017.00000000.344064822.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 00000017.00000002.511764877.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361144483.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000002.386853198.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver2\x64\Release\IndirectDisplayDriver2.pdb source: is-GHBL6.tmp.7.dr
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: devcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, is-SNPR6.tmp.7.dr, SET1884.tmp.21.dr, SET34A8.tmp.25.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyUmd.pdbGCTL source: is-JB1P2.tmp.7.dr, is-7VVLQ.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayBus\Win32\Release\IndirectDisplayBus.pdb source: is-3EUOE.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver0\x64\Release\indirectdisplaydriver0.pdb source: is-V2FIH.tmp.7.dr
Source: Binary string: DpInst.pdb source: is-0A4G1.tmp.7.dr
Source: Binary string: devcon.pdb source: devcon.exe, 00000015.00000002.426309180.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 00000015.00000000.324270292.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 0000001F.00000000.427511561.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, is-MKN2N.tmp.7.dr
Source: Binary string: DpInst.pdbp source: is-0A4G1.tmp.7.dr
Source: Binary string: devcon.pdbGCTL source: devcon.exe, 00000015.00000002.426309180.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 00000015.00000000.324270292.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, devcon.exe, 0000001F.00000000.427511561.00007FF625F08000.00000002.00000001.01000000.0000000A.sdmp, is-MKN2N.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\unimp\miniport\objfre_wnet_amd64\amd64\dfmirage.pdb source: is-PCJE3.tmp.7.dr
Source: Binary string: msvcr120.i386.pdb source: WinUsbDisplay.exe, 00000017.00000002.518142818.000000006C521000.00000020.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayDriver1\x64\Release\IndirectDisplayDriver1.pdb source: is-PDP06.tmp.7.dr
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\libVMonitor.pdb source: WinUsbDisplay.exe, 00000017.00000002.520613004.000000006F6DD000.00000002.00000001.01000000.0000000C.sdmp, WinUsbDisplay.exe, 0000001B.00000002.387616683.000000006F6DD000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\github\virtual-display-ultrasemi\Release\DisplayProxyKmd.pdb source: is-AI2CQ.tmp.7.dr
Source: Binary string: d:\projects\demofo~1\dev\drivers\mirage\mirage~1\objfre_wnet_amd64\amd64\dfmirage.pdb source: is-DG52H.tmp.7.dr
Source: Binary string: C:\fjwang\work\BS7160\BS7160A\tools\MultiIndirectDisplay\IndirectDisplayBus\x64\Release\IndirectDisplayBus.pdb source: drvinst.exe, 00000026.00000003.499328459.000001EC3B0DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Work\Project\MS7130\Windows\USBTest\USM\windows-adapter-display-multidev\Release\WinUsbDisplay.pdb{ source: WinUsbDisplay.exe, 00000017.00000000.344064822.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 00000017.00000002.511764877.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361144483.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000002.386853198.00000000011CF000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.dr

Data Obfuscation

barindex
Obfuscated command line found
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp "C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe"
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp "C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe" Jump to behavior
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB54E0 push esp; retf 2_2_00CB559A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAACFB pushfd ; retf 0000h2_2_00CAAD1A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CA885A push edx; retf 2_2_00CA8A7E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CADC73 push edx; retf 0000h2_2_00CADC76
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CA9838 pushad ; retf 2_2_00CA98AD
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAADCF pushfd ; retf 0000h2_2_00CAADD2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CA9DE1 push eax; retf 2_2_00CA9DE6
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0981 push cs; retf 2_2_00CB0982
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0985 push cs; retf 2_2_00CB0986
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB099C push cs; retf 2_2_00CB09AA
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0994 push cs; retf 2_2_00CB099A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB1159 push ds; retf 2_2_00CB118A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB1D7B push cs; retf 2_2_00CB1D7E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CBA17B pushfd ; retf 2_2_00CBA17E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAAD1D pushfd ; retf 0000h2_2_00CAAD1E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAAD21 pushfd ; retf 0000h2_2_00CAAD22
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB12A4 push eax; retf 2_2_00CB12DE
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB06B3 push es; retf 0000h2_2_00CB06B6
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB3244 push edx; retf 0000h2_2_00CB324E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAAE68 pushfd ; retf 0000h2_2_00CAAE82
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0668 push es; retf 2_2_00CB066A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB5668 push ebx; retf 2_2_00CB5672
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB1E6D push ds; retf 2_2_00CB1E6E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0664 push es; retf 2_2_00CB0666
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB1E71 push ds; retf 2_2_00CB1E72
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CA8FC8 push edx; retf 0000h2_2_00CA8FCE
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CAAFF3 push edx; retf 0000h2_2_00CAAFFA
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB5B8D pushad ; retf 2_2_00CB5E0A
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB0F63 push edx; retf 0000h2_2_00CB0F66
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CA9F74 push esi; retf 0000h2_2_00CA9F76
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00CB6318 push ebp; retf 2_2_00CB631A
Source: MSDisplay_Windows_V2.0.1.7.3.exe.2.drStatic PE information: section name: .didata
Source: MSDisplay_Windows_V2.0.1.7.3.tmp.6.drStatic PE information: section name: .didata
Source: is-D8A40.tmp.7.drStatic PE information: section name: .didata
Source: is-F3A26.tmp.7.drStatic PE information: section name: _RDATA
Source: is-VAK36.tmp.7.drStatic PE information: 0xF132C5BA [Wed Mar 26 01:41:14 2098 UTC]
Source: initial sampleStatic PE information: section name: .text entropy: 6.95576372950548
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\libusb0_x86.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\IndirectDisplayDriver1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\is-3EUOE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\indirectdisplaydriver0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\is-GIP3E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\is-EOKMR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\amd64\libusb0.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\IndirectDisplayDriver2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\x86\is-SNPR6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\arm64\devcon.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x86\devcon.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\IndirectDisplayDriver1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-OMQCP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\IndirectDisplayBus.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x86\dpinst.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\is-V2FIH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\amd64\libusb0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\is-75BQ3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x64\is-JRJP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Users\user\AppData\Local\Temp\is-T5EMD.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\libyuv.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyKmd.sys (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x64\is-DG52H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-D8A40.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x86\dfmirage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyKmd.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x64\devcon.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x64\dfmirage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-2I15K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-A6KB9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x86\is-0A4G1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\IndirectDisplayBus.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\is-GHBL6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\x86\libusb0.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\IndirectDisplayDriver2.dll (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\IndirectDisplayBus.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x64\is-PCJE3.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\x86\libusb0_x86.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\libusb0.dll (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2BDA.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\x86\SET1884.tmpJump to dropped file
Source: C:\Windows\SysWOW64\wget.exeFile created: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-0UQ04.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET12A5.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\SET3328.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\arm64\is-VAK36.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x86\is-H235T.tmpJump to dropped file
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeFile created: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\amd64\is-6A73L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\msvcr120.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\x86\libusb0_x86.dll (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyUmd.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x64\dfmirage.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x86\is-MKN2N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\is-G5BU5.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2D71.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\is-R9A24.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x64\dpinst.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\x86\is-KH3U6.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\x64\SET1E77.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\libVMonitor.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd32.dll (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\libusb0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x86\is-0RNM6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\video_driver\x86\dfmirage.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\indirectdisplaydriver0.dll (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\x64\IndirectDisplayBus.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\lib_usb\amd64\is-JMA70.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\WinUsbDisplay.exe (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\libusb0.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\is-PDP06.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\unins000.exe (copy)Jump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeFile created: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET75A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\Program Files\USM USB Display\tool\x64\is-DMNPK.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\SET34A8.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\libusb0_x86.dll (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2BDA.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2D71.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.dll (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\SET3328.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.sys (copy)Jump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\SET34A8.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\IndirectDisplayBus.sys (copy)Jump to dropped file

Boot Survival

barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\dfmirage\DEVICE0 Attach.ToDesktopJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USM USB DisplayJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USM USB Display\USM USB Display.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USM USB Display\Uninstall USM USB Display.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\dfmirage\DEVICE0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Usb DisplayJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Usb DisplayJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_005C90B4 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,7_2_005C90B4
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_006A68B0 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,7_2_006A68B0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe TID: 4220Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exe TID: 2372Thread sleep time: -34800s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1236Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\IndirectDisplayDriver1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\is-3EUOE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\indirectdisplaydriver0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\is-GIP3E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\is-EOKMR.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\IndirectDisplayDriver2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\lib_usb\x86\is-SNPR6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\arm64\devcon.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x86\devcon.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\IndirectDisplayDriver1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\is-OMQCP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x86\dpinst.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\is-V2FIH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\is-75BQ3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x64\is-JRJP3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T5EMD.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyKmd.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x64\is-DG52H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x86\dfmirage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\is-D8A40.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyKmd.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x64\dfmirage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\is-2I15K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\is-A6KB9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x86\is-0A4G1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\is-GHBL6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\IndirectDisplayDriver2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x64\is-PCJE3.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2BDA.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\x86\SET1884.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\SET3328.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET12A5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\arm64\is-VAK36.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x86\is-H235T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\lib_usb\amd64\is-6A73L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyUmd.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x64\dfmirage.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x86\is-MKN2N.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2D71.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\is-G5BU5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\is-R9A24.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\tool\x64\dpinst.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\lib_usb\x86\is-KH3U6.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\x64\SET1E77.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x86\dfmirage.sys (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\video_driver\x86\is-0RNM6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\indirectdisplaydriver0.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\lib_usb\amd64\is-JMA70.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpDropped PE file which has not been started: C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\is-PDP06.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET75A.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\SET34A8.tmpJump to dropped file
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeWindow / User API: threadDelayed 696Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_7-22024
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004AF91C GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,6_2_004AF91C
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0040AEF4 FindFirstFileW,FindClose,6_2_0040AEF4
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,6_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0060C2B0 FindFirstFileW,GetLastError,7_2_0060C2B0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0040E6A0 FindFirstFileW,FindClose,7_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,7_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_006B8DE4 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,7_2_006B8DE4
Source: svchost.exe, 00000014.00000002.512349157.00000280BDE63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
Source: svchost.exe, 0000001D.00000002.466133431.000001DF53A88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
Source: setupapi.dev.log.21.drBinary or memory string: set: System Product Name: VMware7,1
Source: setupapi.dev.log.21.drBinary or memory string: set: System Manufacturer: VMware, Inc.
Source: wget.exe, svchost.exe, 00000014.00000002.510089074.00000280B8629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.512269085.00000280BDE56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.466319104.000001DF53AD6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.466357188.000001DF53AEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.509459578.000001FC10A02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: setupapi.dev.log.21.drBinary or memory string: set: BIOS Vendor: VMware, Inc.
Source: wget.exe, 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.509745391.000001FC10A28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.510507353.0000023CCDE6C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.510058869.000002126DA29000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus"
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_006A60E8 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,7_2_006A60E8
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_005C8B3C InitializeSecurityDescriptor,SetSecurityDescriptorDacl,7_2_005C8B3C
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_005C7CE0 AllocateAndInitializeSid,GetVersion,GetModuleHandleW,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,7_2_005C7CE0
Source: C:\Windows\SysWOW64\wget.exeQueries volume information: C:\Users\user\Desktop\download VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\MSUSBDisplay.cat VolumeInformationJump to behavior
Source: C:\Program Files\USM USB Display\WinUsbDisplay.exeQueries volume information: C:\Program Files\USM USB Display\vMonitorlog.log VolumeInformation
Source: C:\Program Files\USM USB Display\tool\x64\devcon.exeQueries volume information: C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.cat VolumeInformation
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: GetUserDefaultUILanguage,GetLocaleInfoW,6_2_0040B044
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: GetLocaleInfoW,6_2_0041E034
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: GetLocaleInfoW,6_2_0041E080
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: GetLocaleInfoW,6_2_004AF218
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,6_2_0040A4CC
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: GetUserDefaultUILanguage,GetLocaleInfoW,7_2_0040E7F0
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: GetLocaleInfoW,7_2_006103F8
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,7_2_0040DC78
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_00405AE0 cpuid 6_2_00405AE0
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmpCode function: 7_2_00625754 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle,7_2_00625754
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_0041C3D8 GetLocalTime,6_2_0041C3D8
Source: C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exeCode function: 6_2_004B5114 GetModuleHandleW,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,6_2_004B5114

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
Source: svchost.exe, 00000011.00000002.509901631.00000282C003D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.510155647.00000282C0102000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium1
Ingress Tool Transfer		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
System Shutdown/Reboot
Default Accounts1
Native API		11
Windows Service		1
DLL Side-Loading		11
Deobfuscate/Decode Files or Information		LSASS Memory2
File and Directory Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
Encrypted Channel		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain Accounts112
Command and Scripting Interpreter		111
Registry Run Keys / Startup Folder		1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager46
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)11
Windows Service		1
Software Packing		NTDS1
Query Registry		Distributed Component Object ModelInput CaptureScheduled Transfer3
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon Script2
Process Injection		1
Timestomp		LSA Secrets31
Security Software Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.common111
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Cached Domain Credentials2
Virtualization/Sandbox Evasion		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup Items1
File Deletion		DCSync1
Process Discovery		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job33
Masquerading		Proc Filesystem11
Application Window Discovery		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)2
Virtualization/Sandbox Evasion		/etc/passwd and /etc/shadow2
System Owner/User Discovery		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
Access Token Manipulation		Network Sniffing1
Remote System Discovery		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron2
Process Injection		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 672930 URL: https://github.com/MindShow... Startdate: 25/07/2022 Architecture: WINDOWS Score: 52 7 MSDisplay_Windows_V2.0.1.7.3.exe 2 2->7         started        11 svchost.exe 2->11         started        13 cmd.exe 2 2->13         started        15 16 other processes 2->15 dnsIp3 74 C:\Users\...\MSDisplay_Windows_V2.0.1.7.3.tmp, PE32 7->74 dropped 86 Obfuscated command line found 7->86 18 MSDisplay_Windows_V2.0.1.7.3.tmp 27 95 7->18         started        88 Changes security center settings (notifications, updates, antivirus, firewall) 11->88 22 MpCmdRun.exe 11->22         started        24 wget.exe 2 13->24         started        27 conhost.exe 13->27         started        80 127.0.0.1 unknown unknown 15->80 82 192.168.2.1 unknown unknown 15->82 29 drvinst.exe 20 15->29         started        31 drvinst.exe 15->31         started        file4 signatures5 process6 dnsIp7 56 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 18->56 dropped 70 64 other files (none is malicious) 18->70 dropped 84 Creates an undocumented autostart registry key 18->84 33 devcon.exe 1 14 18->33         started        36 devcon.exe 18->36         started        38 conhost.exe 22->38         started        76 github.com 140.82.121.3, 443, 49738 GITHUBUS United States 24->76 78 raw.githubusercontent.com 185.199.108.133, 443, 49742 FASTLYUS Netherlands 24->78 58 C:\Users\...\MSDisplay_Windows_V2.0.1.7.3.exe, PE32 24->58 dropped 60 C:\Windows\...\libusb0_x86.dll (copy), PE32 29->60 dropped 62 C:\Windows\System32\...\SET34A8.tmp, PE32 29->62 dropped 64 C:\Windows\System32\...\libusb0.sys (copy), PE32+ 29->64 dropped 72 3 other files (none is malicious) 29->72 dropped 66 C:\Windows\System32\...\SET3328.tmp, PE32+ 31->66 dropped 68 C:\Windows\...\IndirectDisplayBus.sys (copy), PE32+ 31->68 dropped file8 signatures9 process10 file11 44 C:\Users\user\...\libusb0_x86.dll (copy), PE32 33->44 dropped 46 C:\Users\user\AppData\Local\...\SET1884.tmp, PE32 33->46 dropped 48 C:\Users\user\AppData\...\libusb0.sys (copy), PE32+ 33->48 dropped 54 3 other files (none is malicious) 33->54 dropped 40 conhost.exe 33->40         started        50 C:\Users\user\AppData\Local\...\SET1E77.tmp, PE32+ 36->50 dropped 52 C:\Users\...\IndirectDisplayBus.sys (copy), PE32+ 36->52 dropped 42 conhost.exe 36->42         started        process12

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe0%VirustotalBrowse
https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe0%Avira URL Cloudsafe

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files\USM USB Display\WinUsbDisplay.exe (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyKmd.sys (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd.dll (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd32.dll (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmp0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmp0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmp0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyKmd.sys (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyUmd.dll (copy)0%MetadefenderBrowse
C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyUmd.dll (copy)0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmp0%MetadefenderBrowse
C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmp0%ReversingLabs
C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://schemas.microft80%URL Reputationsafe
https://www.remobjects.com/ps0%URL Reputationsafe
https://www.innosetup.com/0%URL Reputationsafe
https://www.pango.co/privacy0%URL Reputationsafe
https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
http://crl.ver)0%Avira URL Cloudsafe
https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
https://%s.xboxlive.com0%URL Reputationsafe
https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
https://dynamic.t0%URL Reputationsafe
http://libusb-win32.sourceforge.netb0%Avira URL Cloudsafe
https://disneyplus.com/legal.0%URL Reputationsafe
http://libusb-win32.sourceforge.netN0%Avira URL Cloudsafe
https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe1%VirustotalBrowse
https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe0%Avira URL Cloudsafe
http://help.disneyplus.com.0%URL Reputationsafe
https://%s.dnet.xboxlive.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
github.com
140.82.121.3
truefalse
    		high
    raw.githubusercontent.com
    		185.199.108.133
    		truefalse
      		unknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exefalse
        		high
        https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exefalse
        • 1%, Virustotal, Browse
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUMSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000000.242239784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe.2.drfalse
          		high
          https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313256656.000001EE00047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://www.tightvnc.com/licensing/?f=saWinUsbDisplay.exe, 00000017.00000002.511919631.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361184983.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.drfalse
                        		high
                        https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000E.00000003.313230524.000001EE00041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313533369.000001EE00042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://schemas.microft8svchost.exe, 0000001D.00000002.466319104.000001DF53AD6000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineMSDisplay_Windows_V2.0.1.7.3.exefalse
                            		high
                            https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000E.00000003.313230524.000001EE00041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313533369.000001EE00042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://www.remobjects.com/psMSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243534503.000000007FBA0000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243100248.0000000002550000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp, MSDisplay_Windows_V2.0.1.7.3.tmp, 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp.6.dr, is-D8A40.tmp.7.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://www.hotspotshield.com/terms/svchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.innosetup.com/MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243534503.000000007FBA0000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.exe, 00000006.00000003.243100248.0000000002550000.00000004.00001000.00020000.00000000.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp, MSDisplay_Windows_V2.0.1.7.3.tmp, 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, MSDisplay_Windows_V2.0.1.7.3.tmp.6.dr, is-D8A40.tmp.7.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.pango.co/privacysvchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.wget.exe, wget.exe, 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.bingmapsportal.comsvchost.exe, 0000000E.00000002.313481344.000001EE00013000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://crl.ver)svchost.exe, 00000014.00000002.512349157.00000280BDE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.466357188.000001DF53AEA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		low
                                                    https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000E.00000003.313204204.000001EE00057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe).wget.exe, 00000002.00000002.236027790.00000000012E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.tightvnc.com/?f=sa&TimedWinUsbDisplay.exe, 00000017.00000002.511919631.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, WinUsbDisplay.exe, 0000001B.00000000.361184983.0000000001214000.00000002.00000001.01000000.0000000B.sdmp, is-0UQ04.tmp.7.drfalse
                                                          		high
                                                          https://www.tiktok.com/legal/report/feedbacksvchost.exe, 0000001D.00000003.445444368.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.445494511.000001DF5459E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000E.00000002.313481344.000001EE00013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313527862.000001EE0003E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://%s.xboxlive.comsvchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		low
                                                            https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000E.00000003.313217205.000001EE00045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313256656.000001EE00047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313157048.000001EE0003D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://support.hotspotshield.com/svchost.exe, 0000001D.00000003.438469013.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438074132.000001DF545AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438028805.000001DF5459E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438498573.000001DF54A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438146927.000001DF54A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.437978584.000001DF5458D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.438602417.000001DF5458D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000E.00000003.313204204.000001EE00057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.disneyplus.com/legal/privacy-policysvchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://dynamic.tsvchost.exe, 0000000E.00000002.313544098.000001EE0004E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          http://libusb-win32.sourceforge.netbdevcon.exe, 00000015.00000003.341007329.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356070474.000002C5BE2FB000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366370409.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, is-6A73L.tmp.7.dr, SET12A5.tmp.21.dr, SET2D71.tmp.25.drfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://disneyplus.com/legal.svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000E.00000003.291010988.000001EE00031000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.313242152.000001EE0003A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000E.00000002.313551252.000001EE00058000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://libusb-win32.sourceforge.netNdevcon.exe, 00000015.00000003.345021607.0000025977928000.00000004.00000020.00020000.00000000.sdmp, devcon.exe, 00000015.00000003.335965631.0000025977928000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.359675454.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366479917.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.356046975.000002C5BE34E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000019.00000003.366189992.000002C5BE3AE000.00000004.00000020.00020000.00000000.sdmp, SET75A.tmp.21.dr, is-SNPR6.tmp.7.dr, SET1884.tmp.21.dr, is-JMA70.tmp.7.dr, SET2BDA.tmp.25.dr, SET34A8.tmp.25.drfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://activity.windows.comsvchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000E.00000003.313120142.000001EE00061000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://help.disneyplus.com.svchost.exe, 0000001D.00000003.442262627.000001DF545AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442140943.000001DF5458B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000003.442172137.000001DF5459C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://%s.dnet.xboxlive.comsvchost.exe, 0000000C.00000002.510126323.0000023CCDE3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		low
                                                                                    https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.313555759.000001EE0005E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000E.00000003.313138470.000001EE0005C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high

                                                                                        World Map of Contacted IPs

                                                                                        • No. of IPs < 25%
                                                                                        • 25% < No. of IPs < 50%
                                                                                        • 50% < No. of IPs < 75%
                                                                                        • 75% < No. of IPs

                                                                                        Public IPs

                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                        185.199.108.133
                                                                                        		raw.githubusercontent.comNetherlands
                                                                                        		54113FASTLYUSfalse
                                                                                        140.82.121.3
                                                                                        		github.comUnited States
                                                                                        		36459GITHUBUSfalse

                                                                                        Private

                                                                                        IP
                                                                                        192.168.2.1
                                                                                        127.0.0.1

                                                                                        General Information

                                                                                        Joe Sandbox Version:35.0.0 Citrine
                                                                                        Analysis ID:672930
                                                                                        Start date and time: 25/07/202215:16:422022-07-25 15:16:42 +02:00
                                                                                        Joe Sandbox Product:CloudBasic
                                                                                        Overall analysis duration:0h 10m 31s
                                                                                        Hypervisor based Inspection enabled:false
                                                                                        Report type:full
                                                                                        Cookbook file name:urldownload.jbs
                                                                                        Sample URL:https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe
                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                        Number of analysed new started processes analysed:39
                                                                                        Number of new started drivers analysed:0
                                                                                        Number of existing processes analysed:0
                                                                                        Number of existing drivers analysed:0
                                                                                        Number of injected processes analysed:0
                                                                                        Technologies:
                                                                                        • HCA enabled
                                                                                        • EGA enabled
                                                                                        • HDC enabled
                                                                                        • AMSI enabled
                                                                                        Analysis Mode:default
                                                                                        Analysis stop reason:Timeout
                                                                                        Detection:MAL
                                                                                        Classification:mal52.evad.win@37/149@2/4
                                                                                        EGA Information:
                                                                                        • Successful, ratio: 66.7%
                                                                                        HDC Information:
                                                                                        • Successful, ratio: 55.1% (good quality ratio 53.2%)
                                                                                        • Quality average: 82%
                                                                                        • Quality standard deviation: 25.1%
                                                                                        HCA Information:Failed
                                                                                        Cookbook Comments:
                                                                                        • Adjust boot time
                                                                                        • Enable AMSI

                                                                                        Warnings

                                                                                        • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe
                                                                                        • Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.223.24.244
                                                                                        • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                                                        • Execution Graph export aborted for target wget.exe, PID 6052 because there are no executed function
                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                        Simulations

                                                                                        Behavior and APIs

                                                                                        TimeTypeDescription
                                                                                        15:18:25API Interceptor10x Sleep call for process: svchost.exe modified
                                                                                        15:18:28AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Usb Display C:\Program Files\USM USB Display\WinUsbDisplay.exe
                                                                                        15:18:36AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Usb Display C:\Program Files\USM USB Display\WinUsbDisplay.exe
                                                                                        15:19:18API Interceptor1x Sleep call for process: MpCmdRun.exe modified

                                                                                        Joe Sandbox View / Context

                                                                                        IPs

                                                                                        ⊘No context

                                                                                        Domains

                                                                                        ⊘No context

                                                                                        ASNs

                                                                                        ⊘No context

                                                                                        JA3 Fingerprints

                                                                                        ⊘No context

                                                                                        Dropped Files

                                                                                        ⊘No context

                                                                                        Created / dropped Files

                                                                                        C:\Program Files\USM USB Display\Feedback Note.txt (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):298
                                                                                        Entropy (8bit):4.709089164337212
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ioJCLX2CR3j451y6MFa57VRWzkVwiaZ5MQ1tR1Ti6e51oMen:07lBs51P7VR3V0Hp1tR1te51oMen
                                                                                        MD5:7F4207EA1304993E8533B7A58F3A51B0
                                                                                        SHA1:4BEB49C0869F6BA1E86033C5372A2F3DB3CC36C0
                                                                                        SHA-256:EE8078A7D68D5F9B702C1F5E322D67227A6512E75247D9E950D497E753C62565
                                                                                        SHA-512:63ACE6218308612522E86D4B925D51B4D3E7BD1E34D38662BD7C29F488AAF64EBE8B23D90A56235BE06FDB5E6D4151EAA86A2D617CCFCEA07414BF893AB75290
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:If there is an exception in the program, feedback the file of WinUsbDisplay.log to technical support department .....1.The default location of this file is "C:\Users\xxx\AppData\Roaming\WinUsbDisplay\WinUsbDisplay.log"....2. you can also find the file of WinUsbDisplay.log by running logpath.bat...

                                                                                        C:\Program Files\USM USB Display\WinUsbDisplay.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1493504
                                                                                        Entropy (8bit):6.389011543004096
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:6egc1GQVw8J4aClLU5zUSLR6jO6PBw1g4eI/53F9YF7VIu+udTIyDOBq:PnuU5zZL9Y7F7L+oTIyiBq
                                                                                        MD5:F70F3B35A5543365775F3EBD2C541F3E
                                                                                        SHA1:3687F26CE6FA9F45B868C93DC8474E085BDC79A9
                                                                                        SHA-256:11F90454A71419F60612999B4B5BD4E3A5D6CA4543D37CBFC08245B224DC7A77
                                                                                        SHA-512:8FD9153C15684D9DD84C4759B46E7F997123663B8D5ACA3E148454EAE7DDA7ACA8F2C4BEB2BA6AAD8A2ACA4FDE45F827D27AE4AA93E30E4BE2CC1DBCBF1F7024
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......N..........}~....}|....}}...X...J.X...).X.......D.............8...........w.......:...p...............Rich..........................PE..L......b..........................................@.......................... ............@.................................|...@....@.......................`..<....t..T....................u.......u..@............................................text............................... ..`.rdata..............................@..@.data...PY.......B..................@....rsrc........@......................@..@.reloc..<....`......................@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\config.ini (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:UTF-8 Unicode text
                                                                                        Category:dropped
                                                                                        Size (bytes):353
                                                                                        Entropy (8bit):5.849396057301375
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:96sdN8Vt/Glq31++e5gWSTIHDXp/bmGNsu7D/0yW28wp1geQDOCwggDAt12Y6CLo:q58F1xN7DuVMPWOpgn1X6CL6CsUjs73
                                                                                        MD5:AB5BD4D46AA4F19ED52961F81635AD76
                                                                                        SHA1:37F3E26449DA284D16C28847413294DFBEC2A2DB
                                                                                        SHA-256:A1C6CEDAB9EC5850C98D5FED2CB0A2253FBBCCA7B8C5974F57F34FBDE4DC3C3F
                                                                                        SHA-512:C744DABDD16FD08E8AD0D625AF97CDB82F3D3E45E20FF783DCEBB448B22FBEC5AD95125CD371ABAB1BBD335173062312B244DCE97076AAE88A84A2C0CAA14A6D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:[mem_by_pass_scale].width=400.height=200..[picture_quality].pqmode=1..[frame_swtich].; .... 0...... 1.RGB888.RGB565.....frame_switch_enable=3.; .............(frame_Enable = 2) 12.....12...565. 20.....20...888.frame_avg_fre_0=42.frame_avg_fre_1=18.frame_time=3..

                                                                                        C:\Program Files\USM USB Display\displayproxy\DisplayProxyKmd.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2411
                                                                                        Entropy (8bit):5.559929036972021
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:2X/hoHQ1DsePdiAWfiMoSYo3Qo1/40rz/40mpDBQI2DBfLD7ikpQaSpGWgnr3v+u:wphYnqXWQwAL6sftl0R
                                                                                        MD5:735FDCE617E9F71AE9A798B88C232B7D
                                                                                        SHA1:E9A0820807161B3D8BC9C3CD29DC2580EFDD80A2
                                                                                        SHA-256:A9CD9D499AADCDB3F2968C1A96EAF6AE983AF38529D4303AF52E64FE81CE4268
                                                                                        SHA-512:1766C410BAEC5A421DF3036226FB4F249B6D307FF7E8C0071CBF3AF6467423BA2244E7ABD585E5C04C189C6FE41CF96151C18E79C9BC335EC9CF7F21037BB1B3
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..[Version]..Signature = "$Windows NT$"..Class=System..ClassGUID={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider=%MNF%..DriverVer = 09/19/2021,15.47.24.217..CatalogFile=DisplayProxy.cat..PnpLockdown=1....[DestinationDirs]..Displayproxykmd.CopyFiles = 12 ; drivers..Displayproxyumd.CopyFiles = 11 ; system32..Displayproxyumdwow.CopyFiles = 10, SysWow64 ; x64-specific....[SourceDisksFiles.x86]..DisplayProxyKmd.sys=1,x86..DisplayProxyUmd.dll=1,x86....[SourceDisksFiles.amd64]..DisplayProxyKmd.sys=1,x64..DisplayProxyUmd.dll=1,x64..DisplayProxyUmd32.dll=1,x64....[SourceDisksNames.x86]..1 = %DiskName%....[SourceDisksNames.amd64]..1 = %DiskName%......[Manufacturer]..%MNF%=MNF,NTx86,NTamd64....[MNF.NTx86]..;..;.Allow the driver to be loaded on VGA and XGA..;.."Ultrasemi Display Device" = Display_Inst, Root\UltrasemiDisplayProxy....[MNF.NTamd64]..;..;.Allow the driver to be loaded on VGA and XGA..;.."Ultrasemi Display Device" = Display_Inst, Root\Ult

                                                                                        C:\Program Files\USM USB Display\displayproxy\displayproxy.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):13832
                                                                                        Entropy (8bit):7.413790710533066
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:Mtf6ki20VKG4i271TpkkVEVFJ8ZcGwGBk7/UMQ3a2:M420nc1TukVEV3GPkjd2
                                                                                        MD5:CD3DF3274F80B319AC8C4A57F38098E9
                                                                                        SHA1:7CE7F6825439F147EEB0BEF7BB7298F389F9CBDD
                                                                                        SHA-256:072248ABB8D759370C07F3BAF2C69CF8EE3C48C19657D8D0D89587A6FE0963A9
                                                                                        SHA-512:79D00C04140FE777926C5A1D393118B275A065872E73C42AAABF6814A2993B5DCCE821DD15B964A98B7B0E60485F82C9A27EF6164364385D8DEAB538B13B8730
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.6...*.H........5.0.5....1.0...`.H.e......0..!..+.....7......0...0...+.....7......vw..0tM..V0z.....211124112001Z0...+.....7.....0..80......U..!.........R.21..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0....+49...P.........iy.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(d.i.s.p.l.a.y.p.r.o.x.y.k.m.d...s.y.s...0.... N...=1.|..j..Z.........'.[...L.C1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... N...=1.|..j..Z.........'.[...L.C0......Y..v./.7....4..j1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0.... ..I..........:.).0:..d...Bh1..0.

                                                                                        C:\Program Files\USM USB Display\displayproxy\is-9MJOO.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):13832
                                                                                        Entropy (8bit):7.413790710533066
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:Mtf6ki20VKG4i271TpkkVEVFJ8ZcGwGBk7/UMQ3a2:M420nc1TukVEV3GPkjd2
                                                                                        MD5:CD3DF3274F80B319AC8C4A57F38098E9
                                                                                        SHA1:7CE7F6825439F147EEB0BEF7BB7298F389F9CBDD
                                                                                        SHA-256:072248ABB8D759370C07F3BAF2C69CF8EE3C48C19657D8D0D89587A6FE0963A9
                                                                                        SHA-512:79D00C04140FE777926C5A1D393118B275A065872E73C42AAABF6814A2993B5DCCE821DD15B964A98B7B0E60485F82C9A27EF6164364385D8DEAB538B13B8730
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.6...*.H........5.0.5....1.0...`.H.e......0..!..+.....7......0...0...+.....7......vw..0tM..V0z.....211124112001Z0...+.....7.....0..80......U..!.........R.21..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0....+49...P.........iy.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(d.i.s.p.l.a.y.p.r.o.x.y.k.m.d...s.y.s...0.... N...=1.|..j..Z.........'.[...L.C1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... N...=1.|..j..Z.........'.[...L.C0......Y..v./.7....4..j1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0N..+.....7...1@0>...F.i.l.e.......,d.i.s.p.l.a.y.p.r.o.x.y.u.m.d.3.2...d.l.l...0.... ..I..........:.).0:..d...Bh1..0.

                                                                                        C:\Program Files\USM USB Display\displayproxy\is-AH2C4.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2411
                                                                                        Entropy (8bit):5.559929036972021
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:2X/hoHQ1DsePdiAWfiMoSYo3Qo1/40rz/40mpDBQI2DBfLD7ikpQaSpGWgnr3v+u:wphYnqXWQwAL6sftl0R
                                                                                        MD5:735FDCE617E9F71AE9A798B88C232B7D
                                                                                        SHA1:E9A0820807161B3D8BC9C3CD29DC2580EFDD80A2
                                                                                        SHA-256:A9CD9D499AADCDB3F2968C1A96EAF6AE983AF38529D4303AF52E64FE81CE4268
                                                                                        SHA-512:1766C410BAEC5A421DF3036226FB4F249B6D307FF7E8C0071CBF3AF6467423BA2244E7ABD585E5C04C189C6FE41CF96151C18E79C9BC335EC9CF7F21037BB1B3
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..[Version]..Signature = "$Windows NT$"..Class=System..ClassGUID={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider=%MNF%..DriverVer = 09/19/2021,15.47.24.217..CatalogFile=DisplayProxy.cat..PnpLockdown=1....[DestinationDirs]..Displayproxykmd.CopyFiles = 12 ; drivers..Displayproxyumd.CopyFiles = 11 ; system32..Displayproxyumdwow.CopyFiles = 10, SysWow64 ; x64-specific....[SourceDisksFiles.x86]..DisplayProxyKmd.sys=1,x86..DisplayProxyUmd.dll=1,x86....[SourceDisksFiles.amd64]..DisplayProxyKmd.sys=1,x64..DisplayProxyUmd.dll=1,x64..DisplayProxyUmd32.dll=1,x64....[SourceDisksNames.x86]..1 = %DiskName%....[SourceDisksNames.amd64]..1 = %DiskName%......[Manufacturer]..%MNF%=MNF,NTx86,NTamd64....[MNF.NTx86]..;..;.Allow the driver to be loaded on VGA and XGA..;.."Ultrasemi Display Device" = Display_Inst, Root\UltrasemiDisplayProxy....[MNF.NTamd64]..;..;.Allow the driver to be loaded on VGA and XGA..;.."Ultrasemi Display Device" = Display_Inst, Root\Ult

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyKmd.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):89576
                                                                                        Entropy (8bit):6.653478980768659
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:uwcHEuBArcVlaUSeSKJJwKHcCOB0Q5xP052Gu9cPOE/q:nMArulsK1He5x0m8O8q
                                                                                        MD5:74EB1436CFD88C6B5667CE61C74EBCE9
                                                                                        SHA1:8CF5FE5A5184892AC78C117B41561E8F73F53805
                                                                                        SHA-256:9C878E6686F2FA993E27189F2F26BB5A5E179284148DFA8FDE76DC96EF95ECAA
                                                                                        SHA-512:A404980C25D04F9CD47419ED66281E47519882B89E8DC77C4599A13C97F05F6E1BD3FC89A8485F5E1B767D7D1D782CA681B5A8DE0CE51A575E3240ECCD5B64E7
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+..*...+...+..+..*...+..*...+..*...+..*...+Rich...+........PE..d.....Fa.........."..........&.......0.........@.............................P............`A.................................................0..(............ ..$........M...@..H.......8...............................................0............................text...4........................... ..h.rdata..4...........................@..H.data...H...........................@....pdata..$.... ......................@..HINIT.........0...................... ..b.reloc..H....@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):175648
                                                                                        Entropy (8bit):6.480611220155743
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:q0sM6NbPL8h6HY24RX34U14EG16ipO9GaTXwh3l3g3EoOm:qXbPL8h6HORX31476irVKEw
                                                                                        MD5:6B05847B8A40B5C50ECFC094C57D0435
                                                                                        SHA1:6910A0D8283D359F482A9AB5C98BFF33F7BB75DF
                                                                                        SHA-256:FDFF39037CE9780B25738300597F878964FB90BFF4CB456B3A60396945AF682C
                                                                                        SHA-512:7CA7413482F0F12D13B5AF15E646183BD8A004225F3793A1250378E71FAFC7AD63BA58C4EC109EB75A867D533D845D9B2837A198DD6728AFF9DD9D4D02746C05
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wb....S...S...S*d.R...S*d.Ri..S*d.R...S*d.R...S...S...S.c.R...S.c.R...S.c.R...S.c.R...S.c.R...S.c.R...SRich...S................PE..d...wG+a.........." .................b..............................................V.....`A........................................`B.......B..<............p..p....`.. N..........('..T............................'..8............................................text............................... ..`.rdata..............................@..@.data........P.......4..............@....pdata..p....p.......@..............@..@_RDATA...............V..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\DisplayProxyUmd32.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):147536
                                                                                        Entropy (8bit):6.812722893465503
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:NgMohVbhcxZUa0q3GcPs2sQffECeipzPpQyvthOE:NEDa0q33KipzP2yl9
                                                                                        MD5:160036A7249B9C509CD5852A27F4DE34
                                                                                        SHA1:3DC281E72322FB14BF7F801E0DA8C74F42D8583E
                                                                                        SHA-256:D16382DD9E7334C8B518C164AB6CA7AA9F5E31D482A995F7548DDB345A0AB181
                                                                                        SHA-512:B68D608C913B89799C2FA32617640F7AC7BBA19074EB493B7870C5AA967DFACEB3E593AB0D58C9B77340D43BF7362AFBC97D9DC4F334B4810A77B71CAE8EA796
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................Y........................................................................Rich....................PE..L....G+a...........!.....^..........PU.......p............................... ............@A........................P...........<.......................PR..........\...T...............................@............p..,............................text....].......^.................. ..`.rdata...m...p...n...b..............@..@.data...H...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\is-F3A26.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):175648
                                                                                        Entropy (8bit):6.480611220155743
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:q0sM6NbPL8h6HY24RX34U14EG16ipO9GaTXwh3l3g3EoOm:qXbPL8h6HORX31476irVKEw
                                                                                        MD5:6B05847B8A40B5C50ECFC094C57D0435
                                                                                        SHA1:6910A0D8283D359F482A9AB5C98BFF33F7BB75DF
                                                                                        SHA-256:FDFF39037CE9780B25738300597F878964FB90BFF4CB456B3A60396945AF682C
                                                                                        SHA-512:7CA7413482F0F12D13B5AF15E646183BD8A004225F3793A1250378E71FAFC7AD63BA58C4EC109EB75A867D533D845D9B2837A198DD6728AFF9DD9D4D02746C05
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wb....S...S...S*d.R...S*d.Ri..S*d.R...S*d.R...S...S...S.c.R...S.c.R...S.c.R...S.c.R...S.c.R...S.c.R...SRich...S................PE..d...wG+a.........." .................b..............................................V.....`A........................................`B.......B..<............p..p....`.. N..........('..T............................'..8............................................text............................... ..`.rdata..............................@..@.data........P.......4..............@....pdata..p....p.......@..............@..@_RDATA...............V..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\is-FLTN8.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):89576
                                                                                        Entropy (8bit):6.653478980768659
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:uwcHEuBArcVlaUSeSKJJwKHcCOB0Q5xP052Gu9cPOE/q:nMArulsK1He5x0m8O8q
                                                                                        MD5:74EB1436CFD88C6B5667CE61C74EBCE9
                                                                                        SHA1:8CF5FE5A5184892AC78C117B41561E8F73F53805
                                                                                        SHA-256:9C878E6686F2FA993E27189F2F26BB5A5E179284148DFA8FDE76DC96EF95ECAA
                                                                                        SHA-512:A404980C25D04F9CD47419ED66281E47519882B89E8DC77C4599A13C97F05F6E1BD3FC89A8485F5E1B767D7D1D782CA681B5A8DE0CE51A575E3240ECCD5B64E7
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+..*...+...+..+..*...+..*...+..*...+..*...+Rich...+........PE..d.....Fa.........."..........&.......0.........@.............................P............`A.................................................0..(............ ..$........M...@..H.......8...............................................0............................text...4........................... ..h.rdata..4...........................@..H.data...H...........................@....pdata..$.... ......................@..HINIT.........0...................... ..b.reloc..H....@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x64\is-JB1P2.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):147536
                                                                                        Entropy (8bit):6.812722893465503
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:NgMohVbhcxZUa0q3GcPs2sQffECeipzPpQyvthOE:NEDa0q33KipzP2yl9
                                                                                        MD5:160036A7249B9C509CD5852A27F4DE34
                                                                                        SHA1:3DC281E72322FB14BF7F801E0DA8C74F42D8583E
                                                                                        SHA-256:D16382DD9E7334C8B518C164AB6CA7AA9F5E31D482A995F7548DDB345A0AB181
                                                                                        SHA-512:B68D608C913B89799C2FA32617640F7AC7BBA19074EB493B7870C5AA967DFACEB3E593AB0D58C9B77340D43BF7362AFBC97D9DC4F334B4810A77B71CAE8EA796
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................Y........................................................................Rich....................PE..L....G+a...........!.....^..........PU.......p............................... ............@A........................P...........<.......................PR..........\...T...............................@............p..,............................text....].......^.................. ..`.rdata...m...p...n...b..............@..@.data...H...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyKmd.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):72680
                                                                                        Entropy (8bit):6.978263575533531
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:1xN+0K4gmLahQBaOYfkn7Nfz7B+qWPniub0cDG22rJ9cwOE1:E05gLQfYG79zMqWau5DAJHO8
                                                                                        MD5:928F770BEE13C90A3A50FE5B223DF756
                                                                                        SHA1:9F0A130DE14F1EB1888CD4DA2A1A9355C5A51E70
                                                                                        SHA-256:5129B2ABFA81C3D3F85FCD7C83E1E66C388117042B32BB7D8C940AB4F19F5A91
                                                                                        SHA-512:D718FCE40CB7B7FE4D946728D7F5F76B2BB21C5B46B80493DDA3B03A4193365720843A61650C392F23857DA8C50067ACFA4A8F11627C4F770D4F172EA57C7B9B
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..1a..ba..ba..bu..cd..ba..b,..bu..cg..b9..cm..b9..c`..bRicha..b........PE..L...B.Fa..........................................@.......................................@E................................H...<........................M..........p...8...............................@...............0............................text...4........................... ..h.rdata..............................@..H.data...p...........................@...INIT................................ ..b.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x86\DisplayProxyUmd.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):147544
                                                                                        Entropy (8bit):6.812775396923209
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:PgMohVbhcxZUa0q3GcPs2sQffECeipzPkAgO:PEDa0q33KipzP5
                                                                                        MD5:6768220C7151A3538529D3B589B51809
                                                                                        SHA1:BB2F1BBC08149B38E10C35CE46B53F7E97894880
                                                                                        SHA-256:63DAAEBE01CD4C7F80CFA82C4BD7FEE3EB86FC5F98EA1DB86B240E46DF125740
                                                                                        SHA-512:F6D59316C3855284EA71FD094B4F03CB2F9A4763E303B6481AEC5110473B38BCEBC020F2DD2B7F7DCF08A316702E2E0D22AF9502246D2FD2CCFCAE539ADCEE1C
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................Y........................................................................Rich....................PE..L....G+a...........!.....^..........PU.......p............................... ......#?....@A........................P...........<.......................XR..........\...T...............................@............p..,............................text....].......^.................. ..`.rdata...m...p...n...b..............@..@.data...H...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x86\is-7VVLQ.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):147544
                                                                                        Entropy (8bit):6.812775396923209
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:PgMohVbhcxZUa0q3GcPs2sQffECeipzPkAgO:PEDa0q33KipzP5
                                                                                        MD5:6768220C7151A3538529D3B589B51809
                                                                                        SHA1:BB2F1BBC08149B38E10C35CE46B53F7E97894880
                                                                                        SHA-256:63DAAEBE01CD4C7F80CFA82C4BD7FEE3EB86FC5F98EA1DB86B240E46DF125740
                                                                                        SHA-512:F6D59316C3855284EA71FD094B4F03CB2F9A4763E303B6481AEC5110473B38BCEBC020F2DD2B7F7DCF08A316702E2E0D22AF9502246D2FD2CCFCAE539ADCEE1C
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................Y........................................................................Rich....................PE..L....G+a...........!.....^..........PU.......p............................... ......#?....@A........................P...........<.......................XR..........\...T...............................@............p..,............................text....].......^.................. ..`.rdata...m...p...n...b..............@..@.data...H...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\displayproxy\x86\is-AI2CQ.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):72680
                                                                                        Entropy (8bit):6.978263575533531
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:1xN+0K4gmLahQBaOYfkn7Nfz7B+qWPniub0cDG22rJ9cwOE1:E05gLQfYG79zMqWau5DAJHO8
                                                                                        MD5:928F770BEE13C90A3A50FE5B223DF756
                                                                                        SHA1:9F0A130DE14F1EB1888CD4DA2A1A9355C5A51E70
                                                                                        SHA-256:5129B2ABFA81C3D3F85FCD7C83E1E66C388117042B32BB7D8C940AB4F19F5A91
                                                                                        SHA-512:D718FCE40CB7B7FE4D946728D7F5F76B2BB21C5B46B80493DDA3B03A4193365720843A61650C392F23857DA8C50067ACFA4A8F11627C4F770D4F172EA57C7B9B
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..1a..ba..ba..bu..cd..ba..b,..bu..cg..b9..cm..b9..c`..bRicha..b........PE..L...B.Fa..........................................@.......................................@E................................H...<........................M..........p...8...............................@...............0............................text...4........................... ..h.rdata..............................@..H.data...p...........................@...INIT................................ ..b.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\IndirectDisplayBus.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-DEC5C.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\is-PA7MG.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\IndirectDisplayBus.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\x64\is-GIP3E.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\IndirectDisplayBus.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):24568
                                                                                        Entropy (8bit):6.4893145797760505
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:OVqXv5oxnt4qVR3MtxOgh5I2TpdBJxXxkh36/qlG:OV8Y4qb3MtxBntdBJxh636
                                                                                        MD5:7E95DAB6E06427D3AC1105BF637035D3
                                                                                        SHA1:15FEC0EE39F04DC2CEA1125431099A782B1093A2
                                                                                        SHA-256:174E5860B4F62FE8BCA1FA965BD20860CEB91E3ADE7D179A7E6FC9346E5260B9
                                                                                        SHA-512:EF987E0260BD7A5789D6B5BBBE693C1F989335F0A7591D758E2F1925B91734561BB06A36E817416C388B29B4D7C100606A02083572F9F7D1C5A34568E634DF60
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!8..@V..@V..@V..&P..@V..&S..@V..&U..@V..&Q..@V..@W..@V..&W..@V..&R..@V.o)R..@V.o)...@V.o)T..@V.Rich.@V.................PE..L.....]................."...................0....@.......................................@E................................l`..<....p...............<...#...... ...@1..8...........................x1...............0..$............................text............................... ..h.rdata..h....0......................@..H.data........@......................@...PAGE.........P...................... ..`INIT.........`.......,.............. ..b.rsrc........p......................@..B.reloc.. ............8..............@..B................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaybus\x86\is-3EUOE.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):24568
                                                                                        Entropy (8bit):6.4893145797760505
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:OVqXv5oxnt4qVR3MtxOgh5I2TpdBJxXxkh36/qlG:OV8Y4qb3MtxBntdBJxh636
                                                                                        MD5:7E95DAB6E06427D3AC1105BF637035D3
                                                                                        SHA1:15FEC0EE39F04DC2CEA1125431099A782B1093A2
                                                                                        SHA-256:174E5860B4F62FE8BCA1FA965BD20860CEB91E3ADE7D179A7E6FC9346E5260B9
                                                                                        SHA-512:EF987E0260BD7A5789D6B5BBBE693C1F989335F0A7591D758E2F1925B91734561BB06A36E817416C388B29B4D7C100606A02083572F9F7D1C5A34568E634DF60
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!8..@V..@V..@V..&P..@V..&S..@V..&U..@V..&Q..@V..@W..@V..&W..@V..&R..@V.o)R..@V.o)...@V.o)T..@V.Rich.@V.................PE..L.....]................."...................0....@.......................................@E................................l`..<....p...............<...#...... ...@1..8...........................x1...............0..$............................text............................... ..h.rdata..h....0......................@..H.data........@......................@...PAGE.........P...................... ..`INIT.........`.......,.............. ..b.rsrc........p......................@..B.reloc.. ............8..............@..B................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\IndirectDisplayDriver0.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11401
                                                                                        Entropy (8bit):7.158998538079764
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:L7IzeF1aJCY39JnxrEwJqKkhYCkqUtpwBqnajr2Ep:w9JxXxkh3UqlGEp
                                                                                        MD5:C9E4AADDD74CBE283866ABC68E8C38E6
                                                                                        SHA1:EE8E8EDAEFC3C2190502F99B4AC28458520F4D27
                                                                                        SHA-256:A3CD2595275F0CA648F7BF12E891BAF51A639A6C05D6142DD7FF579B6A142248
                                                                                        SHA-512:09302DD35D8A16FE31D73D2F917CA84B8A06EDD04E2EF2C179AD02C50237CE30D4C45EAE674B91D2BAA15051091F4DCAE0F75CF573267ECDC52AEC83F826A36E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,v0.,r...1.0...`.H.e......0.....+.....7......0...0...+.....7..........2,M.7....'..190917090927Z0...+.....7.....0...0.... .R.. .J....ey...A1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...i.n.f...0..'. Q`.7s..J.(...r......)...=.[...}1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Q`.7s..J.(...r......)...=.[...}0.........Wm..u$d.....+.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...d.l.l...0.... ......t.=..BZ.Mh."..3.p...9..\.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ......t.=..BZ.Mh."..

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\IndirectDisplayDriver0.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4948
                                                                                        Entropy (8bit):3.733316347789815
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Y3oYEYNbnyxyj1l0sOIbdl5VUcfd4diI5KOgTAqGNnijzXLgdHR/5z2x:pYNryxyn/DIAoNni2nCx
                                                                                        MD5:F509D3DD341F960C05FE0EDF3BAFC5AE
                                                                                        SHA1:20EE52EDD420A14AE0ED81BABEDE6579B6E5E041
                                                                                        SHA-256:A7D613CB1B9C74BC3DF9E2425A9D4D681E22E3C2AF339E7093F00539C2075CEC
                                                                                        SHA-512:0551BD4508A0FF7A06C1037E48AB42966E70D3664B707CABE3D74F0C76311567D8AD238012FC79E8B3FDBCA78FF55847740F8B785D5C69CEBDDDB4F9D760977A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.0...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....;.C.l.a.s.s. . . . . . . .=.S.y.s.t.e.m.....;.C.l.a.s.s.G.u.i.d. . . .=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.0...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.0...4.7...8.8.9.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-00D84.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4948
                                                                                        Entropy (8bit):3.733316347789815
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Y3oYEYNbnyxyj1l0sOIbdl5VUcfd4diI5KOgTAqGNnijzXLgdHR/5z2x:pYNryxyn/DIAoNni2nCx
                                                                                        MD5:F509D3DD341F960C05FE0EDF3BAFC5AE
                                                                                        SHA1:20EE52EDD420A14AE0ED81BABEDE6579B6E5E041
                                                                                        SHA-256:A7D613CB1B9C74BC3DF9E2425A9D4D681E22E3C2AF339E7093F00539C2075CEC
                                                                                        SHA-512:0551BD4508A0FF7A06C1037E48AB42966E70D3664B707CABE3D74F0C76311567D8AD238012FC79E8B3FDBCA78FF55847740F8B785D5C69CEBDDDB4F9D760977A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.0...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....;.C.l.a.s.s. . . . . . . .=.S.y.s.t.e.m.....;.C.l.a.s.s.G.u.i.d. . . .=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.0...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.0...4.7...8.8.9.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\is-1FC6M.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11401
                                                                                        Entropy (8bit):7.158998538079764
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:L7IzeF1aJCY39JnxrEwJqKkhYCkqUtpwBqnajr2Ep:w9JxXxkh3UqlGEp
                                                                                        MD5:C9E4AADDD74CBE283866ABC68E8C38E6
                                                                                        SHA1:EE8E8EDAEFC3C2190502F99B4AC28458520F4D27
                                                                                        SHA-256:A3CD2595275F0CA648F7BF12E891BAF51A639A6C05D6142DD7FF579B6A142248
                                                                                        SHA-512:09302DD35D8A16FE31D73D2F917CA84B8A06EDD04E2EF2C179AD02C50237CE30D4C45EAE674B91D2BAA15051091F4DCAE0F75CF573267ECDC52AEC83F826A36E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,v0.,r...1.0...`.H.e......0.....+.....7......0...0...+.....7..........2,M.7....'..190917090927Z0...+.....7.....0...0.... .R.. .J....ey...A1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...i.n.f...0..'. Q`.7s..J.(...r......)...=.[...}1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Q`.7s..J.(...r......)...=.[...}0.........Wm..u$d.....+.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.0...d.l.l...0.... ......t.=..BZ.Mh."..3.p...9..\.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ......t.=..BZ.Mh."..

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\indirectdisplaydriver0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.959824332165052
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:dN2VwhgD8lI4g/Rtqt5W8U6gXXv+VKwzBBoWcZv6:TlgGliRQamjz7ohZv
                                                                                        MD5:9D237DFDB4D1449B4704969BA13BADD5
                                                                                        SHA1:43905EC237632E744DADE006EBEA87403F892799
                                                                                        SHA-256:6B9C1DAA21F9CC0202FC6DFEBF5CAA221EAF2BBE32F2267D9523C3EC7925617B
                                                                                        SHA-512:B72E1BBCEEBB129789DC9BA46CA23ADE9B777067C0513E33FD237CB2FB8AF678B9D99A5B0212533CC5CD21D684F0E3D5971AFF5E841F84BF088BEF0F3D210426
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d......].........." .........t...............................................p...........`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x64\is-V2FIH.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.959824332165052
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:dN2VwhgD8lI4g/Rtqt5W8U6gXXv+VKwzBBoWcZv6:TlgGliRQamjz7ohZv
                                                                                        MD5:9D237DFDB4D1449B4704969BA13BADD5
                                                                                        SHA1:43905EC237632E744DADE006EBEA87403F892799
                                                                                        SHA-256:6B9C1DAA21F9CC0202FC6DFEBF5CAA221EAF2BBE32F2267D9523C3EC7925617B
                                                                                        SHA-512:B72E1BBCEEBB129789DC9BA46CA23ADE9B777067C0513E33FD237CB2FB8AF678B9D99A5B0212533CC5CD21D684F0E3D5971AFF5E841F84BF088BEF0F3D210426
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d......].........." .........t...............................................p...........`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\indirectdisplaydriver0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.460881273142044
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:ZmsnirIgxGqXKOgBWPBs+jK8vcNrGpZ+FhvdXPX70vFPX70J2JZ2R8XM1MUJ7Sjz:ZmFITOgd1RXPL09PL0YJZh81FNyv6A
                                                                                        MD5:B0CFA27BC81CE56D53C4166EA648B6DA
                                                                                        SHA1:A46A3ACD696D27291AD82D632729CC1F0F85E5A0
                                                                                        SHA-256:8FCB7B639145FAFB6A76D175E8FFDE05E0EC5B83936F2067DCD74BB657FB778B
                                                                                        SHA-512:19179F242C39F8C99D4345690061DE07E69AF1BC9D946A0929942CF88DF972DCEC27C63ADEC08CA81B28D5ED78577CFF21FC7851DEACEA5C5D1DC974E59E4834
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L......]...........!.........F.......r....................................................@A............................d...T............................#......`.......8...........................H................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..`...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver0\x86\is-EOKMR.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.460881273142044
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:ZmsnirIgxGqXKOgBWPBs+jK8vcNrGpZ+FhvdXPX70vFPX70J2JZ2R8XM1MUJ7Sjz:ZmFITOgd1RXPL09PL0YJZh81FNyv6A
                                                                                        MD5:B0CFA27BC81CE56D53C4166EA648B6DA
                                                                                        SHA1:A46A3ACD696D27291AD82D632729CC1F0F85E5A0
                                                                                        SHA-256:8FCB7B639145FAFB6A76D175E8FFDE05E0EC5B83936F2067DCD74BB657FB778B
                                                                                        SHA-512:19179F242C39F8C99D4345690061DE07E69AF1BC9D946A0929942CF88DF972DCEC27C63ADEC08CA81B28D5ED78577CFF21FC7851DEACEA5C5D1DC974E59E4834
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L......]...........!.........F.......r....................................................@A............................d...T............................#......`.......8...........................H................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..`...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\IndirectDisplayDriver1.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4718
                                                                                        Entropy (8bit):3.7226462001402583
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Y+oJEhTdbnFxFL8l0sOIbdluVUcfdQsiI59OgTjqGNnijzXL5dm/5Ux:hhxrFxFP/wIzpNninWUx
                                                                                        MD5:1A290DD0ED585F9EBA8B69E0DFE83A46
                                                                                        SHA1:6E875E206C6329BBABCF10C6F432B1FDFC27CDF1
                                                                                        SHA-256:670FBF9CB56901358AE42B70E3E01078814CDC088DB3E761E075D8169028D3CE
                                                                                        SHA-512:57B8D36B45D4738918C3B4EBB20C2CD36C3CACA0C9B3B805DC10E1F1F6E0C320AE7225F444C4FA3FCD9FE71173C18DD3A7C421745318840073AEEC4BD0B2577E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.1...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.1...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.2...1.3...6.8.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.1.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.1.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.o.u.r.c.e.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\indirectdisplaydriver1.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11403
                                                                                        Entropy (8bit):7.165808540835695
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:7UcBWxFJCR39JnxrEwJqKkhYC5X/UtpwBqnajr2mK:2UJxXxkh39aqlGh
                                                                                        MD5:DE33FADEDA395BE70345A8DD3FE66F3D
                                                                                        SHA1:8662C74F217EB22FA50F6C888A43AA61931DD625
                                                                                        SHA-256:C37DBB3A4A0589D22DE4AC734D257FF7692EB5B8B6E9DAE3014D5D42C0F78BCD
                                                                                        SHA-512:6EF4EEB94C8D06AEB28C57C2237FCDC3275CA13CFB8B645FCA4E553631B09B2ADC99298186A2B875DC98EE56CB36DBCA92016148C99A87DD9BB8C6A49E054913
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,x0.,t...1.0...`.H.e......0.....+.....7......0...0...+.....7.....f......O.........190917090927Z0...+.....7.....0...0....%....jv.>..e='.0...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...d.l.l...0.... g....i.5..+p...x.L.....a.u...(..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... g....i.5..+p...x.L.....a.u...(..0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...i.n.f...0..'. j...."_>..L..T.]x.....R.8.f..t1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... j...."_>..L..T.]x.....R.8.f..t0....n.^ lc)......2...'..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-9U9M8.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4718
                                                                                        Entropy (8bit):3.7226462001402583
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Y+oJEhTdbnFxFL8l0sOIbdluVUcfdQsiI59OgTjqGNnijzXL5dm/5Ux:hhxrFxFP/wIzpNninWUx
                                                                                        MD5:1A290DD0ED585F9EBA8B69E0DFE83A46
                                                                                        SHA1:6E875E206C6329BBABCF10C6F432B1FDFC27CDF1
                                                                                        SHA-256:670FBF9CB56901358AE42B70E3E01078814CDC088DB3E761E075D8169028D3CE
                                                                                        SHA-512:57B8D36B45D4738918C3B4EBB20C2CD36C3CACA0C9B3B805DC10E1F1F6E0C320AE7225F444C4FA3FCD9FE71173C18DD3A7C421745318840073AEEC4BD0B2577E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.1...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.1...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.2...1.3...6.8.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.1.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.1.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.o.u.r.c.e.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\is-GQLTN.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11403
                                                                                        Entropy (8bit):7.165808540835695
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:7UcBWxFJCR39JnxrEwJqKkhYC5X/UtpwBqnajr2mK:2UJxXxkh39aqlGh
                                                                                        MD5:DE33FADEDA395BE70345A8DD3FE66F3D
                                                                                        SHA1:8662C74F217EB22FA50F6C888A43AA61931DD625
                                                                                        SHA-256:C37DBB3A4A0589D22DE4AC734D257FF7692EB5B8B6E9DAE3014D5D42C0F78BCD
                                                                                        SHA-512:6EF4EEB94C8D06AEB28C57C2237FCDC3275CA13CFB8B645FCA4E553631B09B2ADC99298186A2B875DC98EE56CB36DBCA92016148C99A87DD9BB8C6A49E054913
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,x0.,t...1.0...`.H.e......0.....+.....7......0...0...+.....7.....f......O.........190917090927Z0...+.....7.....0...0....%....jv.>..e='.0...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...d.l.l...0.... g....i.5..+p...x.L.....a.u...(..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... g....i.5..+p...x.L.....a.u...(..0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...i.n.f...0..'. j...."_>..L..T.]x.....R.8.f..t1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.1...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... j...."_>..L..T.]x.....R.8.f..t0....n.^ lc)......2...'..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\IndirectDisplayDriver1.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.9600020449564175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:/N2VYhgD8lI4g/Rtqt5WxU6oXXv+V1wzIBoWcDv6:FNgGliRQxmYzaohDv
                                                                                        MD5:CBBB8ACB68E87B5DE9A19DB85662C6CF
                                                                                        SHA1:92B573A79FCC475AB469907D5D1E84577654EA9C
                                                                                        SHA-256:8340F3295C287ADF4A972387198BE4B679535403D699920CCE7C6B2DB9D85ECF
                                                                                        SHA-512:E4B62791EF36352971E503825E5109EDCB4C7FDF1490E09CA85FEFC8DF3DFE96E0EE5A2208DA79828F36034EB1F62C076B9397C1608D55325E71E84B6714EA42
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d......].........." .........t...............................................p.......6....`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x64\is-PDP06.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.9600020449564175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:/N2VYhgD8lI4g/Rtqt5WxU6oXXv+V1wzIBoWcDv6:FNgGliRQxmYzaohDv
                                                                                        MD5:CBBB8ACB68E87B5DE9A19DB85662C6CF
                                                                                        SHA1:92B573A79FCC475AB469907D5D1E84577654EA9C
                                                                                        SHA-256:8340F3295C287ADF4A972387198BE4B679535403D699920CCE7C6B2DB9D85ECF
                                                                                        SHA-512:E4B62791EF36352971E503825E5109EDCB4C7FDF1490E09CA85FEFC8DF3DFE96E0EE5A2208DA79828F36034EB1F62C076B9397C1608D55325E71E84B6714EA42
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d......].........." .........t...............................................p.......6....`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\IndirectDisplayDriver1.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.461606527414898
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:GGsniLQQxGqnKOgB7sPRs+jK8/sNrMHHSqhuk0U4SUS2/yskZ6sUueJxh63:GG1QzOgzojhih9rLv6
                                                                                        MD5:A3464A7B31EE6DDBD6B243226E10B9C3
                                                                                        SHA1:9E3E523C2220510B346E6107F59E63CB8B4B9AF4
                                                                                        SHA-256:47A10E729356565E3E7176B99659F5A9E8036F860C29FF79780F055F14172D7D
                                                                                        SHA-512:98741533F1C49B6AB9EB40A5F1D119E506952EC009717C67AA2286BCE9A80D7D5BEE73E01DDDA1BEE3E0C9377F4894A85F54A9B721518CD1D9F8815E03B8041D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L......]...........!.........F.......r..............................................%.....@A............................d...d............................#......d... ...8...........................X................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver1\x86\is-G5BU5.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.461606527414898
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:GGsniLQQxGqnKOgB7sPRs+jK8/sNrMHHSqhuk0U4SUS2/yskZ6sUueJxh63:GG1QzOgzojhih9rLv6
                                                                                        MD5:A3464A7B31EE6DDBD6B243226E10B9C3
                                                                                        SHA1:9E3E523C2220510B346E6107F59E63CB8B4B9AF4
                                                                                        SHA-256:47A10E729356565E3E7176B99659F5A9E8036F860C29FF79780F055F14172D7D
                                                                                        SHA-512:98741533F1C49B6AB9EB40A5F1D119E506952EC009717C67AA2286BCE9A80D7D5BEE73E01DDDA1BEE3E0C9377F4894A85F54A9B721518CD1D9F8815E03B8041D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L......]...........!.........F.......r..............................................%.....@A............................d...d............................#......d... ...8...........................X................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\IndirectDisplayDriver2.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4720
                                                                                        Entropy (8bit):3.7246366000888695
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YFoJEK2nbnkxkznl0sOIbdlzVUcfdofiI5kOgTmqGNnijzXLSdb/5Ux:QK+rkxk3/pImqNniUlUx
                                                                                        MD5:FF38793324E4AF343573524225F2A4A3
                                                                                        SHA1:E48CDE0AD711982C6611D39FA0A969C23A8E84C4
                                                                                        SHA-256:25C7A126C122AD18FE4EC50BFCFB911DDB95FFBE80719FD5BECD5BBA8852C759
                                                                                        SHA-512:2AF0D13A9D5A3812B8D17F24F61479FB22A420F47BBFF5F8CC299AF964CB8FA55D1966C1C742AABFA5E476F2027FAB74C5B898E9E3AC78DAB75A411422C77987
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.2...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.2...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.2...3.9...1.0.0.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.2.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.2.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.o.u.r.c.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\indirectdisplaydriver2.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11402
                                                                                        Entropy (8bit):7.1683328662372725
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:xDLuwSkJCO39JnxrEwJqKkhYCJUtpwBqnajr2ba:HjJxXxkh3sqlGba
                                                                                        MD5:64447CBD6BDF03BF174273E82BD0C852
                                                                                        SHA1:848F25616C3ED5C32CD9A6039193DD60C446A2D0
                                                                                        SHA-256:D4411EDD20575BB8151AAA8D4894FB0D249D623D8BE76735A168F6A8C4E9E6F1
                                                                                        SHA-512:7C3D198FF1B679491090E5A1A8F6A4EF1EFD3CCE90E35B6F4210B058702911EB22366450609BB57C83E1683686321F403E337CB25FE5F6A639BF68D3E5EAD266
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,w0.,s...1.0...`.H.e......0.....+.....7......0...0...+.....7............@..K....Q..190917090927Z0...+.....7.....0...0..'. ..c..P..Sy/)..V.sG....\..Eo..B.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..c..P..Sy/)..V.sG....\..Eo..B.0.... %.&."...N..........q...[..R.Y1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... %.&."...N..........q...[..R.Y0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...i.n.f...0......\..;s..7.)..Q....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...d.l.l...0..........,f....i.:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-72IH6.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11402
                                                                                        Entropy (8bit):7.1683328662372725
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:xDLuwSkJCO39JnxrEwJqKkhYCJUtpwBqnajr2ba:HjJxXxkh3sqlGba
                                                                                        MD5:64447CBD6BDF03BF174273E82BD0C852
                                                                                        SHA1:848F25616C3ED5C32CD9A6039193DD60C446A2D0
                                                                                        SHA-256:D4411EDD20575BB8151AAA8D4894FB0D249D623D8BE76735A168F6A8C4E9E6F1
                                                                                        SHA-512:7C3D198FF1B679491090E5A1A8F6A4EF1EFD3CCE90E35B6F4210B058702911EB22366450609BB57C83E1683686321F403E337CB25FE5F6A639BF68D3E5EAD266
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,...*.H........,w0.,s...1.0...`.H.e......0.....+.....7......0...0...+.....7............@..K....Q..190917090927Z0...+.....7.....0...0..'. ..c..P..Sy/)..V.sG....\..Eo..B.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..c..P..Sy/)..V.sG....\..Eo..B.0.... %.&."...N..........q...[..R.Y1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... %.&."...N..........q...[..R.Y0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...i.n.f...0......\..;s..7.)..Q....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.d.r.i.v.e.r.2...d.l.l...0..........,f....i.:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\is-CU32L.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4720
                                                                                        Entropy (8bit):3.7246366000888695
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YFoJEK2nbnkxkznl0sOIbdlzVUcfdofiI5kOgTmqGNnijzXLSdb/5Ux:QK+rkxk3/pImqNniUlUx
                                                                                        MD5:FF38793324E4AF343573524225F2A4A3
                                                                                        SHA1:E48CDE0AD711982C6611D39FA0A969C23A8E84C4
                                                                                        SHA-256:25C7A126C122AD18FE4EC50BFCFB911DDB95FFBE80719FD5BECD5BBA8852C759
                                                                                        SHA-512:2AF0D13A9D5A3812B8D17F24F61479FB22A420F47BBFF5F8CC299AF964CB8FA55D1966C1C742AABFA5E476F2027FAB74C5B898E9E3AC78DAB75A411422C77987
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;.....;. .I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.2...i.n.f.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.D.r.i.v.e.r.2...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...5.2...3.9...1.0.0.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.x.8.6.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.x.8.6.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.2.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.M.y.D.e.v.i.c.e._.I.n.s.t.a.l.l.,. .M.S.\.I.d.d.B.u.s.2.;. .T.O.D.O.:. .e.d.i.t. .h.w.-.i.d.........[.S.o.u.r.c.

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\IndirectDisplayDriver2.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.95834138790578
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:VN2VYhgD8lI4g/Rtqt5WSU6wXXv+VfwzvBoWcev6a:rNgGliRQgmGz5ohev5
                                                                                        MD5:2E3C6F7E0EFC3A6E4B01AC7D276148A5
                                                                                        SHA1:C45CB4E05E36085A4EC142B820D599E6E25F721B
                                                                                        SHA-256:63085EA17E1B8B10DF669CAA2A7C5ACE0BCB57406A87784CB0D84E6200548106
                                                                                        SHA-512:E7CB9FC89C5458CDDA41C2E5B7AB1E38515A94ECE5DF0F104B0682A405084D446F7946F0458B714043DD1CA0ABE231DBE9A85A5D4088A66E66F2289C58C985C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d...\..].........." .........t...............................................p............`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x64\is-GHBL6.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):85496
                                                                                        Entropy (8bit):5.95834138790578
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:VN2VYhgD8lI4g/Rtqt5WSU6wXXv+VfwzvBoWcev6a:rNgGliRQgmGz5ohev5
                                                                                        MD5:2E3C6F7E0EFC3A6E4B01AC7D276148A5
                                                                                        SHA1:C45CB4E05E36085A4EC142B820D599E6E25F721B
                                                                                        SHA-256:63085EA17E1B8B10DF669CAA2A7C5ACE0BCB57406A87784CB0D84E6200548106
                                                                                        SHA-512:E7CB9FC89C5458CDDA41C2E5B7AB1E38515A94ECE5DF0F104B0682A405084D446F7946F0458B714043DD1CA0ABE231DBE9A85A5D4088A66E66F2289C58C985C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H'.&t.&t.&t.."u.&t..%u.&t..#u.&t..!u.&t..t.&t..'u.&t.'t..&t...t.&t...t.&t...t.&t].#u.&t].&u.&t].$u.&tRich.&t........................PE..d...\..].........." .........t...............................................p............`A........................................`...`....................@.......*...#...`..........8........................... ................................................text...)........................... ..`.rdata...P.......R..................@..@.data........0......................@....pdata.......@......................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\IndirectDisplayDriver2.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.461970078611847
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:PGsniLQQxGqnKOgB7sPRs+jK8/sNrMHHSFh9L0U4SUS2/ysq6zhUusJxh63ZLYW:PG1QzOgzoKhih9Ahv6l
                                                                                        MD5:EC2BA26EAE286D411FBE7F795E27F03B
                                                                                        SHA1:D884B95D8EA31CB46978BAA3696E05FB5C0B4C03
                                                                                        SHA-256:CC334161C8213FE9AB3853BC7F18F9938BA08B5A89984843E214322DAC05C376
                                                                                        SHA-512:E957B3419624734321AD4623337CFF325CFB51A8E08C7F8AECF220632EAE3ED149CEE13AEB39697BE46F84ADA12D81F3B0A366EB399C00CEB7ABC89E5358816D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L...e..]...........!.........F.......r..............................................DQ....@A............................d...d............................#......d... ...8...........................X................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\idd\indirectdisplaydriver2\x86\is-75BQ3.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):67064
                                                                                        Entropy (8bit):6.461970078611847
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:PGsniLQQxGqnKOgB7sPRs+jK8/sNrMHHSFh9L0U4SUS2/ysq6zhUusJxh63ZLYW:PG1QzOgzoKhih9Ahv6l
                                                                                        MD5:EC2BA26EAE286D411FBE7F795E27F03B
                                                                                        SHA1:D884B95D8EA31CB46978BAA3696E05FB5C0B4C03
                                                                                        SHA-256:CC334161C8213FE9AB3853BC7F18F9938BA08B5A89984843E214322DAC05C376
                                                                                        SHA-512:E957B3419624734321AD4623337CFF325CFB51A8E08C7F8AECF220632EAE3ED149CEE13AEB39697BE46F84ADA12D81F3B0A366EB399C00CEB7ABC89E5358816D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.[...[...[.......W.......S.......y...>...Z...R.O...>...^...[...........Y.......Z.......X.......Z.......Z...Rich[...........PE..L...e..]...........!.........F.......r..............................................DQ....@A............................d...d............................#......d... ...8...........................X................................................text.............................. ..`.rdata...5.......6..................@..@.data...............................@....reloc..d...........................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\is-0UQ04.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1493504
                                                                                        Entropy (8bit):6.389011543004096
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:6egc1GQVw8J4aClLU5zUSLR6jO6PBw1g4eI/53F9YF7VIu+udTIyDOBq:PnuU5zZL9Y7F7L+oTIyiBq
                                                                                        MD5:F70F3B35A5543365775F3EBD2C541F3E
                                                                                        SHA1:3687F26CE6FA9F45B868C93DC8474E085BDC79A9
                                                                                        SHA-256:11F90454A71419F60612999B4B5BD4E3A5D6CA4543D37CBFC08245B224DC7A77
                                                                                        SHA-512:8FD9153C15684D9DD84C4759B46E7F997123663B8D5ACA3E148454EAE7DDA7ACA8F2C4BEB2BA6AAD8A2ACA4FDE45F827D27AE4AA93E30E4BE2CC1DBCBF1F7024
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......N..........}~....}|....}}...X...J.X...).X.......D.............8...........w.......:...p...............Rich..........................PE..L......b..........................................@.......................... ............@.................................|...@....@.......................`..<....t..T....................u.......u..@............................................text............................... ..`.rdata..............................@..@.data...PY.......B..................@....rsrc........@......................@..@.reloc..<....`......................@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\is-2I15K.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):157696
                                                                                        Entropy (8bit):6.530410261503524
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:G2Y0Mwh8du2QIk1iJu6tkLkmr1CKJtXm7x+QPl3Uhiu7w:l9gtQL1isfkm5ntSSP7w
                                                                                        MD5:10BB929E9FD8B028738B46F4D3EA741E
                                                                                        SHA1:4C9FA3B9D175DF3652DA2DDAA0C1228E40FF8E32
                                                                                        SHA-256:8817EAF691058E091E3A240547B74C3E396DAFF1312F66971274C1D30C55BDE1
                                                                                        SHA-512:762E4166DC8364A1938CBF2A3FB299186218626699CF51EFCA851FEF15EFEF83F4C93A81454977575CBECAAB2B64DE927B0FFA1036DEB2FD044461230741AE2C
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1S..P=..P=..P=..">..P=.."8.QP=.."9..P=.%9..P=.%>..P=.%8..P=.."<..P=..P<.P=.%4..P=.%=..P=.%...P=..P...P=.%?..P=.Rich.P=.........PE..L....j.a...........!................m=....................................................@.........................`C......dD..d....p..............................t2..p............................2..@............................................text...x........................... ..`.rdata...~..........................@..@.data........P.......@..............@....rsrc........p.......L..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\is-A2VEK.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:MS Windows icon resource - 10 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
                                                                                        Category:dropped
                                                                                        Size (bytes):92854
                                                                                        Entropy (8bit):5.453773902492667
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:P9nmo8prUKgnXM9J9MMJMMMyMMMcMMMNGMMMJMMMpMMMVMMM1MMMRMMMdMM3MMHB:1J8prUKgnXM9a6f3uB685S
                                                                                        MD5:2098EF97358FBBDFAE0206BBCB4E2234
                                                                                        SHA1:3C0AC8BA58B2CE26CD50CD6990A7A8E093C16BD6
                                                                                        SHA-256:DE96747834EF6ED07618AA7EB89F643444F3BA01140EED263468C08A0B7BF8FE
                                                                                        SHA-512:FEBFBCDC6351630076973670AD29F94A6D15149C8840492FE974D6E967E82AB5D733155518F5F43127B147E89814619250D342BAB55BE09C7A5C40452E95C9A9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:......00......h....... ......................(.......00.............. ......................h...n"........ .(....'..00.... ..%.../.. .... ......U........ .h...Nf..(...0...`...................................................................................................................................................................................................wpppwwwwwwww..pwp........xww.wwwwwwpwww.............wpwwpwwp.......................w............wpppx.......pppwp...........w.wwwwpw..................p.wp.....................www.....................wwp............w.w.xw.wwwww.w.w.xw.x................................................p.......................p.......................p...edfFGdgdfVdgFeftfGh.p...ggwwvx|.xhxv.vw.wgO.p...|v.g...~w...~|.vg.o.p...vw...~x.~x.......v.p...||w.v.w........go.p...v.|v.x.|.........|x.p...|~w..g.~wx.......go.p...wg.w~xh..........|h.p...~wv~x.....o......go.p...|w.|.............gO.p...xh.xo...........G..p...|.w..............go.p......wx..

                                                                                        C:\Program Files\USM USB Display\is-A6KB9.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):234400
                                                                                        Entropy (8bit):6.643119711667771
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:3bHFztdRJyVgeP6VgISLBlzPTxDxSZQWV1DLjGNx:3bHxtdDyVgeCzZQWbk
                                                                                        MD5:1954CD248E65C7C5C2D3D93DD7F91604
                                                                                        SHA1:FE781C2AE615AC242AAF61A2CEF46E43DCCE2058
                                                                                        SHA-256:761EC2283460F3E641F9C815A015698B3EB77090808768A4BF3C17439CCD0018
                                                                                        SHA-512:BE8D518448EA9A317067FE92EBCB71E35AD311CE9EE26E86D80CAD1C9F6392280299379E9BADFC08F31F37878C2F576DD168F6D54F19989B461642AE12792113
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h].`;].`;].`;P..;^.`;P..;U.`;P..;Q.`;P..;_.`;...;_.`;].a;{.`;x..;r.`;x..;\.`;P..;\.`;x..;\.`;Rich].`;........PE..L....Y.Z...........!.........>......=........ ............................................@.........................01......<B..<....`...............B...Q...p..D...................................`0..@............ ...............................text............................... ..`.rdata...%... ...&..................@..@.data...p....P.......,..............@....rsrc........`.......0..............@..@.reloc..D....p.......2..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\is-D8A40.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3224637
                                                                                        Entropy (8bit):6.368977694068352
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:aEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVB3338E:q92bz2Eb6pd7B6bAGx7/333x
                                                                                        MD5:9F254C419CAA3ED3B1BACC6DA5D2368F
                                                                                        SHA1:07C336BE4D716684097B6480FFDB3ECA90C99896
                                                                                        SHA-256:35D4CF20B11374140FDADB3C49F5C4513C3023FFB6E4C7ED8ED8E5162DA75681
                                                                                        SHA-512:F3B5AE53CAFEA464506552B72B67B466E90D89FDC039FBC9C9A73B9FF4DAD9F00EDECBB08B9A723192B45DF719920464A539E66786B17E1F95170CA473036458
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...(..`.................:,.........`F,......P,...@...........................1...........@......@....................-......p-.29....-.......................................................-......................y-.......-......................text.....,.......,................. ..`.itext...(... ,..*....,............. ..`.data........P,......>,.............@....bss.....y....,..........................idata..29...p-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@..............1.......0.............@..@........................................................

                                                                                        C:\Program Files\USM USB Display\is-IA2R2.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):298
                                                                                        Entropy (8bit):4.709089164337212
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ioJCLX2CR3j451y6MFa57VRWzkVwiaZ5MQ1tR1Ti6e51oMen:07lBs51P7VR3V0Hp1tR1te51oMen
                                                                                        MD5:7F4207EA1304993E8533B7A58F3A51B0
                                                                                        SHA1:4BEB49C0869F6BA1E86033C5372A2F3DB3CC36C0
                                                                                        SHA-256:EE8078A7D68D5F9B702C1F5E322D67227A6512E75247D9E950D497E753C62565
                                                                                        SHA-512:63ACE6218308612522E86D4B925D51B4D3E7BD1E34D38662BD7C29F488AAF64EBE8B23D90A56235BE06FDB5E6D4151EAA86A2D617CCFCEA07414BF893AB75290
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:If there is an exception in the program, feedback the file of WinUsbDisplay.log to technical support department .....1.The default location of this file is "C:\Users\xxx\AppData\Roaming\WinUsbDisplay\WinUsbDisplay.log"....2. you can also find the file of WinUsbDisplay.log by running logpath.bat...

                                                                                        C:\Program Files\USM USB Display\is-JCE9I.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):125
                                                                                        Entropy (8bit):4.908131862349433
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:mxNguj51oGWQVOQmLADABOA5cVSREaKC5MQ15yMR1o7/:Gt519VucIOckSiaZ5MQ1tR1I
                                                                                        MD5:F9E5204741AC0FFEC1662139FD77C62F
                                                                                        SHA1:94B9D591160D1DA261A1185625A9B3BFA607F05D
                                                                                        SHA-256:33A17C00E1AD43CA60D0146F3ED783108D64FCA426CD3F97D97A60FB2B1E57DF
                                                                                        SHA-512:E1C5B4662673AFA0095FB5880B874EB217BCC0CCFE936E8115B4E36EB27A55EF02CCF87C392B85C0DFE287076D1CFD9770A403D041AE7BB0215EB5FC7B29DAD0
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:@echo The file of WinUsbDisplay.log in your computer is: %USERPROFILE%\AppData\Roaming\WinUsbDisplay\WinUsbDisplay.log..pause

                                                                                        C:\Program Files\USM USB Display\is-MOJ63.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:UTF-8 Unicode text
                                                                                        Category:dropped
                                                                                        Size (bytes):353
                                                                                        Entropy (8bit):5.849396057301375
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:96sdN8Vt/Glq31++e5gWSTIHDXp/bmGNsu7D/0yW28wp1geQDOCwggDAt12Y6CLo:q58F1xN7DuVMPWOpgn1X6CL6CsUjs73
                                                                                        MD5:AB5BD4D46AA4F19ED52961F81635AD76
                                                                                        SHA1:37F3E26449DA284D16C28847413294DFBEC2A2DB
                                                                                        SHA-256:A1C6CEDAB9EC5850C98D5FED2CB0A2253FBBCCA7B8C5974F57F34FBDE4DC3C3F
                                                                                        SHA-512:C744DABDD16FD08E8AD0D625AF97CDB82F3D3E45E20FF783DCEBB448B22FBEC5AD95125CD371ABAB1BBD335173062312B244DCE97076AAE88A84A2C0CAA14A6D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:[mem_by_pass_scale].width=400.height=200..[picture_quality].pqmode=1..[frame_swtich].; .... 0...... 1.RGB888.RGB565.....frame_switch_enable=3.; .............(frame_Enable = 2) 12.....12...565. 20.....20...888.frame_avg_fre_0=42.frame_avg_fre_1=18.frame_time=3..

                                                                                        C:\Program Files\USM USB Display\is-OMQCP.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):975776
                                                                                        Entropy (8bit):6.973946282494984
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:SBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJ9:KmFyjLF847eiWWcoGZVOIxh/WxIAIbj
                                                                                        MD5:7FC50D24FBF0186FF7C1734511C640C1
                                                                                        SHA1:70939CEE5156B97E993CAB90A70B9FEE871EE336
                                                                                        SHA-256:F5B3848E09E3C9AF9E764FCA6AB61E22D374707A964739373FE9692B58E9A1B4
                                                                                        SHA-512:765DEB4AC696794221485CB01A861CBE86F73E0EFAD2242797F35C262BE7CF5F5B2378AE29B7160A987C9177F3E71DFCBCB21A764CD6BDE6AF3D2178C8AA6328
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D.....................................................@.........................`........R..(....p...................Q......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\is-R9A24.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79776
                                                                                        Entropy (8bit):6.944446560111018
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:+y9hmU73cXNX2lXKSabMpgoPnD2f1MW05agxhqs6Oqs:+QmUuXYWMprC05ZxhqJOq
                                                                                        MD5:A969E398CC9319DD9BD9EEDCAE288DA7
                                                                                        SHA1:09B68BB4CB13B472D65E8279CAFC5FB0E736D650
                                                                                        SHA-256:3165D5E9212E9C4F009A594F67BD9E6D899B026CE1E3B0D6EBB994F423D6B1D1
                                                                                        SHA-512:99E870CCE3A8EF9DCCEE675294334C5C85794EDC5618E7C6CCC5CEE17E2A0F19D015994917BEB74F17A3814FE8914836F97067BE110E002A4A76C2CC0F7B5F65
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@..................................Y....@.........................`...q...L............................Q...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\libVMonitor.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):157696
                                                                                        Entropy (8bit):6.530410261503524
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:G2Y0Mwh8du2QIk1iJu6tkLkmr1CKJtXm7x+QPl3Uhiu7w:l9gtQL1isfkm5ntSSP7w
                                                                                        MD5:10BB929E9FD8B028738B46F4D3EA741E
                                                                                        SHA1:4C9FA3B9D175DF3652DA2DDAA0C1228E40FF8E32
                                                                                        SHA-256:8817EAF691058E091E3A240547B74C3E396DAFF1312F66971274C1D30C55BDE1
                                                                                        SHA-512:762E4166DC8364A1938CBF2A3FB299186218626699CF51EFCA851FEF15EFEF83F4C93A81454977575CBECAAB2B64DE927B0FFA1036DEB2FD044461230741AE2C
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1S..P=..P=..P=..">..P=.."8.QP=.."9..P=.%9..P=.%>..P=.%8..P=.."<..P=..P<.P=.%4..P=.%=..P=.%...P=..P...P=.%?..P=.Rich.P=.........PE..L....j.a...........!................m=....................................................@.........................`C......dD..d....p..............................t2..p............................2..@............................................text...x........................... ..`.rdata...~..........................@..@.data........P.......@..............@....rsrc........p.......L..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\MSUSBDisplay.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Program Files\USM USB Display\lib_usb\amd64\is-6A73L.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\amd64\is-JMA70.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\amd64\libusb0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\amd64\libusb0.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\is-BOERA.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Program Files\USM USB Display\lib_usb\is-E9T21.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Program Files\USM USB Display\lib_usb\msusbdisplay.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Program Files\USM USB Display\lib_usb\x86\is-KH3U6.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):48256
                                                                                        Entropy (8bit):7.145601796339831
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:vT9ifqiIJ8VjPchUaOcgiTan6xLVNe9zz20nc1uTqV1VaXLkjqc:aaIP2hTan6nNazz9cYqP0Nc
                                                                                        MD5:DD7CBC472DAC3BBBF5D3F55CAB642627
                                                                                        SHA1:8A8BBA5C21EE66956A71D16B0254E643F768CD14
                                                                                        SHA-256:774253AB0057E9E03624A53EFF39D21D702EE2CD3CB251C2E5FDA0E092626B7C
                                                                                        SHA-512:6A81E0E3A0055A0B8CD17650BE69A5C29B22C0157C54781802D8546C0D3850307F36C765F1825CECB6DFF2E1A4AAC6492837A5CACFE76B6422C1EEC128D98A1C
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................9..{}p.(}p.(}p.(}p.(Np.($S.(xp.(Z..(gp.(Z..(|p.(Z..(|p.(Rich}p.(........PE..L....X.L.................Z...........\.......Y...............................j..............................................D\..<....a...............j...R...e.......Y...............................................Y...............................text....T.......T.................. ..h.rdata..(....Y.......Y..............@..H.data...|....[.......[..............@...INIT....L....\.......\.............. ....rsrc...

                                                                                        C:\Program Files\USM USB Display\lib_usb\x86\is-SNPR6.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\lib_usb\x86\libusb0.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):48256
                                                                                        Entropy (8bit):7.145601796339831
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:vT9ifqiIJ8VjPchUaOcgiTan6xLVNe9zz20nc1uTqV1VaXLkjqc:aaIP2hTan6nNazz9cYqP0Nc
                                                                                        MD5:DD7CBC472DAC3BBBF5D3F55CAB642627
                                                                                        SHA1:8A8BBA5C21EE66956A71D16B0254E643F768CD14
                                                                                        SHA-256:774253AB0057E9E03624A53EFF39D21D702EE2CD3CB251C2E5FDA0E092626B7C
                                                                                        SHA-512:6A81E0E3A0055A0B8CD17650BE69A5C29B22C0157C54781802D8546C0D3850307F36C765F1825CECB6DFF2E1A4AAC6492837A5CACFE76B6422C1EEC128D98A1C
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................9..{}p.(}p.(}p.(}p.(Np.($S.(xp.(Z..(gp.(Z..(|p.(Z..(|p.(Rich}p.(........PE..L....X.L.................Z...........\.......Y...............................j..............................................D\..<....a...............j...R...e.......Y...............................................Y...............................text....T.......T.................. ..h.rdata..(....Y.......Y..............@..H.data...|....[.......[..............@...INIT....L....\.......\.............. ....rsrc...

                                                                                        C:\Program Files\USM USB Display\lib_usb\x86\libusb0_x86.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\libusb0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79776
                                                                                        Entropy (8bit):6.944446560111018
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:+y9hmU73cXNX2lXKSabMpgoPnD2f1MW05agxhqs6Oqs:+QmUuXYWMprC05ZxhqJOq
                                                                                        MD5:A969E398CC9319DD9BD9EEDCAE288DA7
                                                                                        SHA1:09B68BB4CB13B472D65E8279CAFC5FB0E736D650
                                                                                        SHA-256:3165D5E9212E9C4F009A594F67BD9E6D899B026CE1E3B0D6EBB994F423D6B1D1
                                                                                        SHA-512:99E870CCE3A8EF9DCCEE675294334C5C85794EDC5618E7C6CCC5CEE17E2A0F19D015994917BEB74F17A3814FE8914836F97067BE110E002A4A76C2CC0F7B5F65
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@..................................Y....@.........................`...q...L............................Q...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\libyuv.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):234400
                                                                                        Entropy (8bit):6.643119711667771
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:3bHFztdRJyVgeP6VgISLBlzPTxDxSZQWV1DLjGNx:3bHxtdDyVgeCzZQWbk
                                                                                        MD5:1954CD248E65C7C5C2D3D93DD7F91604
                                                                                        SHA1:FE781C2AE615AC242AAF61A2CEF46E43DCCE2058
                                                                                        SHA-256:761EC2283460F3E641F9C815A015698B3EB77090808768A4BF3C17439CCD0018
                                                                                        SHA-512:BE8D518448EA9A317067FE92EBCB71E35AD311CE9EE26E86D80CAD1C9F6392280299379E9BADFC08F31F37878C2F576DD168F6D54F19989B461642AE12792113
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h].`;].`;].`;P..;^.`;P..;U.`;P..;Q.`;P..;_.`;...;_.`;].a;{.`;x..;r.`;x..;\.`;P..;\.`;x..;\.`;Rich].`;........PE..L....Y.Z...........!.........>......=........ ............................................@.........................01......<B..<....`...............B...Q...p..D...................................`0..@............ ...............................text............................... ..`.rdata...%... ...&..................@..@.data...p....P.......,..............@....rsrc........`.......0..............@..@.reloc..D....p.......2..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\logo.ico (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:MS Windows icon resource - 10 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
                                                                                        Category:dropped
                                                                                        Size (bytes):92854
                                                                                        Entropy (8bit):5.453773902492667
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:P9nmo8prUKgnXM9J9MMJMMMyMMMcMMMNGMMMJMMMpMMMVMMM1MMMRMMMdMM3MMHB:1J8prUKgnXM9a6f3uB685S
                                                                                        MD5:2098EF97358FBBDFAE0206BBCB4E2234
                                                                                        SHA1:3C0AC8BA58B2CE26CD50CD6990A7A8E093C16BD6
                                                                                        SHA-256:DE96747834EF6ED07618AA7EB89F643444F3BA01140EED263468C08A0B7BF8FE
                                                                                        SHA-512:FEBFBCDC6351630076973670AD29F94A6D15149C8840492FE974D6E967E82AB5D733155518F5F43127B147E89814619250D342BAB55BE09C7A5C40452E95C9A9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:......00......h....... ......................(.......00.............. ......................h...n"........ .(....'..00.... ..%.../.. .... ......U........ .h...Nf..(...0...`...................................................................................................................................................................................................wpppwwwwwwww..pwp........xww.wwwwwwpwww.............wpwwpwwp.......................w............wpppx.......pppwp...........w.wwwwpw..................p.wp.....................www.....................wwp............w.w.xw.wwwww.w.w.xw.x................................................p.......................p.......................p...edfFGdgdfVdgFeftfGh.p...ggwwvx|.xhxv.vw.wgO.p...|v.g...~w...~|.vg.o.p...vw...~x.~x.......v.p...||w.v.w........go.p...v.|v.x.|.........|x.p...|~w..g.~wx.......go.p...wg.w~xh..........|h.p...~wv~x.....o......go.p...|w.|.............gO.p...xh.xo...........G..p...|.w..............go.p......wx..

                                                                                        C:\Program Files\USM USB Display\logpath.Bat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):125
                                                                                        Entropy (8bit):4.908131862349433
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:mxNguj51oGWQVOQmLADABOA5cVSREaKC5MQ15yMR1o7/:Gt519VucIOckSiaZ5MQ1tR1I
                                                                                        MD5:F9E5204741AC0FFEC1662139FD77C62F
                                                                                        SHA1:94B9D591160D1DA261A1185625A9B3BFA607F05D
                                                                                        SHA-256:33A17C00E1AD43CA60D0146F3ED783108D64FCA426CD3F97D97A60FB2B1E57DF
                                                                                        SHA-512:E1C5B4662673AFA0095FB5880B874EB217BCC0CCFE936E8115B4E36EB27A55EF02CCF87C392B85C0DFE287076D1CFD9770A403D041AE7BB0215EB5FC7B29DAD0
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:@echo The file of WinUsbDisplay.log in your computer is: %USERPROFILE%\AppData\Roaming\WinUsbDisplay\WinUsbDisplay.log..pause

                                                                                        C:\Program Files\USM USB Display\msvcr120.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):975776
                                                                                        Entropy (8bit):6.973946282494984
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:SBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJ9:KmFyjLF847eiWWcoGZVOIxh/WxIAIbj
                                                                                        MD5:7FC50D24FBF0186FF7C1734511C640C1
                                                                                        SHA1:70939CEE5156B97E993CAB90A70B9FEE871EE336
                                                                                        SHA-256:F5B3848E09E3C9AF9E764FCA6AB61E22D374707A964739373FE9692B58E9A1B4
                                                                                        SHA-512:765DEB4AC696794221485CB01A861CBE86F73E0EFAD2242797F35C262BE7CF5F5B2378AE29B7160A987C9177F3E71DFCBCB21A764CD6BDE6AF3D2178C8AA6328
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....|OR.........."!................D.....................................................@.........................`........R..(....p...................Q......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\arm64\devcon.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (console), for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):103328
                                                                                        Entropy (8bit):5.707075164232896
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Pfap4r1tQJL4dwPMUjUPc5VowWjFMqO7WSLqs/HTqs:qooLvMxPcQThM3WSLqSHTq
                                                                                        MD5:34AE27BA06A815876E4F8144DA60DD3E
                                                                                        SHA1:3221C3E3C620B7C179FAC1EF05BD56AFECBF7B46
                                                                                        SHA-256:2716D6ED1986AC28E1FE05D39D4A0C8C780B502FF87DB73EAB83460969A70BA2
                                                                                        SHA-512:642868FBBE1C1D289416C702228144C67DF894A9D0699E8B90BD1CFA001C03E8B9A883AF3EB8F66EDD57A1D50BCBD52E53F28ED35110A6BDCEA87BF81E39D367
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..(.r.{.r.{.r.{K..z<r.{K..z*r.{K..z*r.{K..z#r.{.r.{Yr.{K..z-r.{K.t{/r.{K..z/r.{Rich.r.{........PE..d.....2..........."......d..........@m.........@.....................................s....`.......... ......................................x...........x.......X....B...Q...p..........T............................................................................text....c.......d.................. ..`.rdata..r........ ...h..............@..@.data...H...........................@....pdata..X...........................@..@.rsrc...x...........................@..@.reloc.......p.......@..............@..B................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\arm64\is-VAK36.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (console), for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):103328
                                                                                        Entropy (8bit):5.707075164232896
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Pfap4r1tQJL4dwPMUjUPc5VowWjFMqO7WSLqs/HTqs:qooLvMxPcQThM3WSLqSHTq
                                                                                        MD5:34AE27BA06A815876E4F8144DA60DD3E
                                                                                        SHA1:3221C3E3C620B7C179FAC1EF05BD56AFECBF7B46
                                                                                        SHA-256:2716D6ED1986AC28E1FE05D39D4A0C8C780B502FF87DB73EAB83460969A70BA2
                                                                                        SHA-512:642868FBBE1C1D289416C702228144C67DF894A9D0699E8B90BD1CFA001C03E8B9A883AF3EB8F66EDD57A1D50BCBD52E53F28ED35110A6BDCEA87BF81E39D367
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..(.r.{.r.{.r.{K..z<r.{K..z*r.{K..z*r.{K..z#r.{.r.{Yr.{K..z-r.{K.t{/r.{K..z/r.{Rich.r.{........PE..d.....2..........."......d..........@m.........@.....................................s....`.......... ......................................x...........x.......X....B...Q...p..........T............................................................................text....c.......d.................. ..`.rdata..r........ ...h..............@..@.data...H...........................@....pdata..X...........................@..@.rsrc...x...........................@..@.reloc.......p.......@..............@..B................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x64\devcon.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):103328
                                                                                        Entropy (8bit):5.706288910087048
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:N9g/ah3d0HrCAAqQa2tjeiMF4O7WO4qsTLqs:NnGWANQa2yiyRWO4qoLq
                                                                                        MD5:8C7D36AD908F5F1A5E39F95AC92581F5
                                                                                        SHA1:17CC6C5E59673B8E0F37C28D012CBDBE0EB9B700
                                                                                        SHA-256:47B29D06A9B26E5802264CCBE1F535F63ACD3C6E6270A80E72E18219C864501B
                                                                                        SHA-512:A5081D6793B152F29A91456F880B21FB9E582B596BCC1CAA14DAB8565C88B153265F8EB948A685775A1E9344A9FA4F123234B5B26860531854692C6359A9C483
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0..Q..Q..Q....H.Q....K.Q....J.Q....V.Q..Q...Q....N.Q....T.Q....I.Q..Rich.Q..........................PE..d.....2V.........."......b..........Pj.........@....................................a.....`.......... ...............................................................B...Q..............8...........................@................................................text...@a.......b.................. ..`.rdata... ......."...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc...............@..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x64\dpinst.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):691616
                                                                                        Entropy (8bit):5.9902529204269115
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:GsW7OzpPId26dQcEaUrPvwgwkRVagRoOQTiHaQsVIhVLpHf2mmPH:+IId79EaUTvwieMowXzZ2tPH
                                                                                        MD5:3FDE18BFCF43B81A0E786FDD139636E0
                                                                                        SHA1:CAC3112FB0E238549DC81E56190E88DCA847CD8F
                                                                                        SHA-256:04373716C1A9661AD8F6713B12E9A6BA2D3112D2ECBC81EB1D40BD3ED230E268
                                                                                        SHA-512:F90AB2E4B5C7C4E5E1D9D13E986BB44C1EC0002E15D2DC77ACFFD9CF7D6638445D061A0AB9E03AB29A3CDE040D6CFBA57D5D34EE2520494165733DBC4C89217E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J.........."..........P...............................................p......C.....@.......... ......................................H...@............0..\m...<...Q...`.......................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc................v..............@..@.reloc..<....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x64\is-DMNPK.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):103328
                                                                                        Entropy (8bit):5.706288910087048
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:N9g/ah3d0HrCAAqQa2tjeiMF4O7WO4qsTLqs:NnGWANQa2yiyRWO4qoLq
                                                                                        MD5:8C7D36AD908F5F1A5E39F95AC92581F5
                                                                                        SHA1:17CC6C5E59673B8E0F37C28D012CBDBE0EB9B700
                                                                                        SHA-256:47B29D06A9B26E5802264CCBE1F535F63ACD3C6E6270A80E72E18219C864501B
                                                                                        SHA-512:A5081D6793B152F29A91456F880B21FB9E582B596BCC1CAA14DAB8565C88B153265F8EB948A685775A1E9344A9FA4F123234B5B26860531854692C6359A9C483
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0..Q..Q..Q....H.Q....K.Q....J.Q....V.Q..Q...Q....N.Q....T.Q....I.Q..Rich.Q..........................PE..d.....2V.........."......b..........Pj.........@....................................a.....`.......... ...............................................................B...Q..............8...........................@................................................text...@a.......b.................. ..`.rdata... ......."...f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc...............@..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x64\is-JRJP3.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):691616
                                                                                        Entropy (8bit):5.9902529204269115
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:GsW7OzpPId26dQcEaUrPvwgwkRVagRoOQTiHaQsVIhVLpHf2mmPH:+IId79EaUTvwieMowXzZ2tPH
                                                                                        MD5:3FDE18BFCF43B81A0E786FDD139636E0
                                                                                        SHA1:CAC3112FB0E238549DC81E56190E88DCA847CD8F
                                                                                        SHA-256:04373716C1A9661AD8F6713B12E9A6BA2D3112D2ECBC81EB1D40BD3ED230E268
                                                                                        SHA-512:F90AB2E4B5C7C4E5E1D9D13E986BB44C1EC0002E15D2DC77ACFFD9CF7D6638445D061A0AB9E03AB29A3CDE040D6CFBA57D5D34EE2520494165733DBC4C89217E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J.........."..........P...............................................p......C.....@.......... ......................................H...@............0..\m...<...Q...`.......................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc................v..............@..@.reloc..<....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x86\devcon.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):97184
                                                                                        Entropy (8bit):5.816041772996807
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Eiq1GxAg85me0rfAJMsa2tjdMF4O7WV2X9FqsxWHFqs:EiqExAf5me0rfAJMsa2hyRWV2tFqblq
                                                                                        MD5:D6B17CDD4CC04750A1072DB648BBF1DA
                                                                                        SHA1:1CB6A4B4D94475ADF77EF7134EF435896184C189
                                                                                        SHA-256:0E0DB9E42D04F54D9787FC26BA3CB3775D5C31B294215670B7400BC23A71BD4F
                                                                                        SHA-512:791C29E79128D96586ECDC10FE69B40FF6D450EE25F7A38FD25322AC1E0AE2D024335D5BF484FE8AB704AD5792801C5C5EB70E73A7181EC9E96BF08BEA32A0C2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..ei..ei..ei.L.i..ei.L.i..ei.L.i..ei.L.i..ei..di..ei.L.i..ei.L.i..ei.L.i..eiRich..ei........................PE..L.....2V.................^..........0f.......p....@..........................P............@...... ..................................................*...Q...@......`...8...............................@............................................text....\.......^.................. ..`.data... ....p.......b..............@....idata..Z............d..............@..@.rsrc................t..............@..@.reloc.......@.......$..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x86\dpinst.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):566176
                                                                                        Entropy (8bit):6.230921459360904
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:uZQaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIUmPkr+LyIQjI:uZqSpwmxvL/f3vCNkPkrAyIQjI
                                                                                        MD5:3BA6A12C0D0DBE0FFFF548D890439B8C
                                                                                        SHA1:8261E2331774D14951B11505BDEB0C8AAC0CC6A5
                                                                                        SHA-256:3BBBE096B208ED9733DC71F30060301A952BD758AA3DA34CE5B3600B1F67F0D0
                                                                                        SHA-512:1A099734D3C71176885C4A9795E2FCF86FD5F88A58E4F89D2251C0242B443170AAD68D19FCCB2B3AA49EE2170BF43FA488BA096660A23C8A92FEDD1B09304BDC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..o4..<4..<4..<=.`<"..<=.v<...<=.f<)..<4..<@..<=.q<o..<=.a<5..<=.d<5..<Rich4..<................PE..L......J................. ...V......j........0......................................*.....@...... ..............................,....p...............R...Q...0..XC...................................=..@...............L............................text............ .................. ..`.data...`>...0.......$..............@....rsrc........p.......<..............@..@.reloc..._...0...`..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x86\is-0A4G1.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):566176
                                                                                        Entropy (8bit):6.230921459360904
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:uZQaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIUmPkr+LyIQjI:uZqSpwmxvL/f3vCNkPkrAyIQjI
                                                                                        MD5:3BA6A12C0D0DBE0FFFF548D890439B8C
                                                                                        SHA1:8261E2331774D14951B11505BDEB0C8AAC0CC6A5
                                                                                        SHA-256:3BBBE096B208ED9733DC71F30060301A952BD758AA3DA34CE5B3600B1F67F0D0
                                                                                        SHA-512:1A099734D3C71176885C4A9795E2FCF86FD5F88A58E4F89D2251C0242B443170AAD68D19FCCB2B3AA49EE2170BF43FA488BA096660A23C8A92FEDD1B09304BDC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..o4..<4..<4..<=.`<"..<=.v<...<=.f<)..<4..<@..<=.q<o..<=.a<5..<=.d<5..<Rich4..<................PE..L......J................. ...V......j........0......................................*.....@...... ..............................,....p...............R...Q...0..XC...................................=..@...............L............................text............ .................. ..`.data...`>...0.......$..............@....rsrc........p.......<..............@..@.reloc..._...0...`..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\tool\x86\is-MKN2N.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):97184
                                                                                        Entropy (8bit):5.816041772996807
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Eiq1GxAg85me0rfAJMsa2tjdMF4O7WV2X9FqsxWHFqs:EiqExAf5me0rfAJMsa2hyRWV2tFqblq
                                                                                        MD5:D6B17CDD4CC04750A1072DB648BBF1DA
                                                                                        SHA1:1CB6A4B4D94475ADF77EF7134EF435896184C189
                                                                                        SHA-256:0E0DB9E42D04F54D9787FC26BA3CB3775D5C31B294215670B7400BC23A71BD4F
                                                                                        SHA-512:791C29E79128D96586ECDC10FE69B40FF6D450EE25F7A38FD25322AC1E0AE2D024335D5BF484FE8AB704AD5792801C5C5EB70E73A7181EC9E96BF08BEA32A0C2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..ei..ei..ei.L.i..ei.L.i..ei.L.i..ei.L.i..ei..di..ei.L.i..ei.L.i..ei.L.i..eiRich..ei........................PE..L.....2V.................^..........0f.......p....@..........................P............@...... ..................................................*...Q...@......`...8...............................@............................................text....\.......^.................. ..`.data... ....p.......b..............@....idata..Z............d..............@..@.rsrc................t..............@..@.reloc.......@.......$..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\unins000.dat

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):26946
                                                                                        Entropy (8bit):3.9444655070166954
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:00nqOHRFSLjCrJOIHCabPI1/szsfKWvMw6DvLH3:0FYk6HdbPWvqL
                                                                                        MD5:EAF7DD9CC3649269B27153A7FFC08EAF
                                                                                        SHA1:2391FCA289868234E3F3B95B695403252DD9EEE3
                                                                                        SHA-256:A7E9B83300824237A559CF61937E06AFB66424ED4822B0EEEEA45EB585DCC846
                                                                                        SHA-512:F7B8DD75146E92DE1446719BC75FD3FBB926A0061804002905F8051FA341989850A30A4F883572AA28439892EA2541F792D6D2E0144ED0655513F4B9FE5BB97E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:Inno Setup Uninstall Log (b) 64-bit.............................{509DC88F-BC75-4AED-B511-9892EAD1AE48}}.........................................................................................USM USB Display.....................................................................................................................d...Bi..................................................................................................................g(D-.........{........{........4.0.5.4.6.4......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y....................Y.. .....2(.......IFPS....(..."....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TSETUPSTEP.........TEXECWAIT.............!OPENARRAYOFCONS

                                                                                        C:\Program Files\USM USB Display\unins000.exe (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3224637
                                                                                        Entropy (8bit):6.368977694068352
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:aEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVB3338E:q92bz2Eb6pd7B6bAGx7/333x
                                                                                        MD5:9F254C419CAA3ED3B1BACC6DA5D2368F
                                                                                        SHA1:07C336BE4D716684097B6480FFDB3ECA90C99896
                                                                                        SHA-256:35D4CF20B11374140FDADB3C49F5C4513C3023FFB6E4C7ED8ED8E5162DA75681
                                                                                        SHA-512:F3B5AE53CAFEA464506552B72B67B466E90D89FDC039FBC9C9A73B9FF4DAD9F00EDECBB08B9A723192B45DF719920464A539E66786B17E1F95170CA473036458
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...(..`.................:,.........`F,......P,...@...........................1...........@......@....................-......p-.29....-.......................................................-......................y-.......-......................text.....,.......,................. ..`.itext...(... ,..*....,............. ..`.data........P,......>,.............@....bss.....y....,..........................idata..29...p-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@..............1.......0.............@..@........................................................

                                                                                        C:\Program Files\USM USB Display\video_driver\dfmirage.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):37087
                                                                                        Entropy (8bit):7.517526997242037
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:0wqfaQCVUValkjbK20nc1ehVEV3GPkjjk2g/VUValkj5QV:09iQCqsv9cKOEYTgqss+
                                                                                        MD5:4725651911AD221A0CDEFF797E2C6F47
                                                                                        SHA1:16439B9AF9FCC660F69AA8DB8207B2C1CA597971
                                                                                        SHA-256:1CA7B07078B8A6DB120E162BA7C840BE0B00AB00A48E125BA6C439B601A4CB03
                                                                                        SHA-512:00C743871C74012F70E2CDDFC8E392EEEA81F5F99423A3A6AA4527518C5ABC18D50CE2AA1F3BA951BEE13D29D121A8D5A4F9E75E02D13D770C9591A444DB7B89
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.....*.H..........0......1.0...+......0.....+.....7......0...0...+.....7......oo..p$I.z.,X+/...080304162004Z0...+.....7.....0...0....R0.7.9.8.8.B.4.1.9.4.9.4.7.9.1.7.4.B.D.2.F.B.5.1.A.E.4.1.F.C.4.2.4.1.1.4.4.1.E.4...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.5...2...0<..+.....7...1.0,...F.i.l.e........d.f.m.i.r.a.g.e...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........A..y.K..Q.A.BA.A.0....R6.6.3.5.A.E.F.3.1.9.0.F.B.B.C.3.9.E.1.A.1.A.D.0.D.5.F.E.5.9.5.C.6.F.A.B.7.F.E.B...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.5...2...0<..+.....7...1.0,...F.i.l.e........d.f.m.i.r.a.g.e...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........f5...........Y\o...0....R6.9.3.F.6.3.4.E.B.4.A.C.0.B.E.E.2.8.D.4

                                                                                        C:\Program Files\USM USB Display\video_driver\dfmirage.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2357
                                                                                        Entropy (8bit):5.398666934306814
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Qh8rhMhvOZnpA2Kqbx5pYAO6IXWd2WB3n2lzUlFTPPa:blMh2pAmDulAGlglFLPa
                                                                                        MD5:FCA869ED2E4441A235EE85EF3C35E92F
                                                                                        SHA1:F8710A2BFC7091B909EF990F18E70630B3DDEA84
                                                                                        SHA-256:71AA40B8A284EA119DA69DFCC2E1BF79EDA0A1696C09934C93EA2109CA806C4F
                                                                                        SHA-512:8DF3820FA92DD7ACB70D2ECB09A38FC262AD6ACAE97A4DD7FB1594FB02AA0EA9E175C373AA536DC5E063CF4E9B6F82E4C107A1551781FE03571C259579094601
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; dfmirage.inf..;..; Installation inf for the Mirage Driver...; Copyright (c) 2002-2008 DemoForge, LLC. All rights reserved...;....[Version]..Signature="$Windows NT$"..ClassGUID={4D36E968-E325-11CE-BFC1-08002BE10318}..Class=Display..Provider=DemoForge, LLC..DriverVer=01/11/2008,2.0.105.0..CatalogFile=dfmirage.cat....[DestinationDirs]..DF.DstDir.Miniport = 12 ; \system32\drivers..DF.DstDir.Display = 11 ; \system32....;..; Driver information..;....[Manufacturer]..%DF% = DFMirage.Mfg, NTx86, NTamd64....[DFMirage.Mfg.NTx86]..%Mirage% = DFMirage, dfmirage....[DFMirage.Mfg.NTamd64]..%Mirage% = DFMirage, dfmirage....[DFMirage.Mfg]....; Models..[DFMirage]..CopyFiles= DF.DstDir.Miniport, DF.DstDir.Display....; Files..[DF.DstDir.Miniport]..dfmirage.sys....[DF.DstDir.Display]..dfmirage.dll....[DFMirage.Services]..AddService = dfmirage, 0x00000002, dfmirage_Service_Inst, dfmirage_EventLog_Inst....; Installing service..[dfmirage_Service_Inst]..ServiceType = 1 ; SERVICE_KERNEL_DRIVER.

                                                                                        C:\Program Files\USM USB Display\video_driver\is-33D8F.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:Windows setup INFormation, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2357
                                                                                        Entropy (8bit):5.398666934306814
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Qh8rhMhvOZnpA2Kqbx5pYAO6IXWd2WB3n2lzUlFTPPa:blMh2pAmDulAGlglFLPa
                                                                                        MD5:FCA869ED2E4441A235EE85EF3C35E92F
                                                                                        SHA1:F8710A2BFC7091B909EF990F18E70630B3DDEA84
                                                                                        SHA-256:71AA40B8A284EA119DA69DFCC2E1BF79EDA0A1696C09934C93EA2109CA806C4F
                                                                                        SHA-512:8DF3820FA92DD7ACB70D2ECB09A38FC262AD6ACAE97A4DD7FB1594FB02AA0EA9E175C373AA536DC5E063CF4E9B6F82E4C107A1551781FE03571C259579094601
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; dfmirage.inf..;..; Installation inf for the Mirage Driver...; Copyright (c) 2002-2008 DemoForge, LLC. All rights reserved...;....[Version]..Signature="$Windows NT$"..ClassGUID={4D36E968-E325-11CE-BFC1-08002BE10318}..Class=Display..Provider=DemoForge, LLC..DriverVer=01/11/2008,2.0.105.0..CatalogFile=dfmirage.cat....[DestinationDirs]..DF.DstDir.Miniport = 12 ; \system32\drivers..DF.DstDir.Display = 11 ; \system32....;..; Driver information..;....[Manufacturer]..%DF% = DFMirage.Mfg, NTx86, NTamd64....[DFMirage.Mfg.NTx86]..%Mirage% = DFMirage, dfmirage....[DFMirage.Mfg.NTamd64]..%Mirage% = DFMirage, dfmirage....[DFMirage.Mfg]....; Models..[DFMirage]..CopyFiles= DF.DstDir.Miniport, DF.DstDir.Display....; Files..[DF.DstDir.Miniport]..dfmirage.sys....[DF.DstDir.Display]..dfmirage.dll....[DFMirage.Services]..AddService = dfmirage, 0x00000002, dfmirage_Service_Inst, dfmirage_EventLog_Inst....; Installing service..[dfmirage_Service_Inst]..ServiceType = 1 ; SERVICE_KERNEL_DRIVER.

                                                                                        C:\Program Files\USM USB Display\video_driver\is-9I04T.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):37087
                                                                                        Entropy (8bit):7.517526997242037
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:0wqfaQCVUValkjbK20nc1ehVEV3GPkjjk2g/VUValkj5QV:09iQCqsv9cKOEYTgqss+
                                                                                        MD5:4725651911AD221A0CDEFF797E2C6F47
                                                                                        SHA1:16439B9AF9FCC660F69AA8DB8207B2C1CA597971
                                                                                        SHA-256:1CA7B07078B8A6DB120E162BA7C840BE0B00AB00A48E125BA6C439B601A4CB03
                                                                                        SHA-512:00C743871C74012F70E2CDDFC8E392EEEA81F5F99423A3A6AA4527518C5ABC18D50CE2AA1F3BA951BEE13D29D121A8D5A4F9E75E02D13D770C9591A444DB7B89
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.....*.H..........0......1.0...+......0.....+.....7......0...0...+.....7......oo..p$I.z.,X+/...080304162004Z0...+.....7.....0...0....R0.7.9.8.8.B.4.1.9.4.9.4.7.9.1.7.4.B.D.2.F.B.5.1.A.E.4.1.F.C.4.2.4.1.1.4.4.1.E.4...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.5...2...0<..+.....7...1.0,...F.i.l.e........d.f.m.i.r.a.g.e...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........A..y.K..Q.A.BA.A.0....R6.6.3.5.A.E.F.3.1.9.0.F.B.B.C.3.9.E.1.A.1.A.D.0.D.5.F.E.5.9.5.C.6.F.A.B.7.F.E.B...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.5...2...0<..+.....7...1.0,...F.i.l.e........d.f.m.i.r.a.g.e...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........f5...........Y\o...0....R6.9.3.F.6.3.4.E.B.4.A.C.0.B.E.E.2.8.D.4

                                                                                        C:\Program Files\USM USB Display\video_driver\x64\dfmirage.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):65520
                                                                                        Entropy (8bit):6.707645180597379
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:fZ0VsKqTDSO+Svm+ldunI1Z2Aqf5VUValkjndO2muVUValkjVX20nc1HPWVEV3GZ:f+qR+RXNhqs2nNqseX9cuOEQ6R
                                                                                        MD5:398931E2E5D0500F211648A67468AEA5
                                                                                        SHA1:EF5310DAF008705FAA3A10A7424C6BED0B13EE0D
                                                                                        SHA-256:8239B9C6B9E2FDD395D488B3E5AA0FF96A8E9B3F94F644FCF7051A47F2D72130
                                                                                        SHA-512:B2D1312735722E236AABB0BFD3007C2D0661DE11D2130674F313A4B0F9946B48D10F0E7DEFD8208EBC7EC20AC4A5BB97C5535DC99B1BF0C9B6794B3BBDA18F7A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....s...s...s...r.:.s.n,....s.?w....s.?w....s.n,....s.?w....s.?w....s.?w....s.Rich..s.........................PE..d.....G.........." .....f...........o..........................................................................................................(........................}......,....................................................................................text....a.......b.................. ..h.rdata...............f..............@..H.data................n..............@....pdata...............r..............@..HINIT.................x.............. ....rsrc................|..............@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\video_driver\x64\dfmirage.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):64584
                                                                                        Entropy (8bit):6.217578252848295
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:n2rTNK12/kvuSZinAIyxNwsqfFVUValkj7zJ20nc1HGVEV3GPkjtP2gbVUValkjb:2ai+xNwhNqs+l9cmOEmeOqsc
                                                                                        MD5:62A9F1A11D646A04527E02C5A23F5DF4
                                                                                        SHA1:91FD156321742014C103B13196819DDB8E119CA9
                                                                                        SHA-256:6062739682C36A04785FA20D234C9903F82C7CD3EEE3508E9B047156FAF3F3CA
                                                                                        SHA-512:CA9A0FB916AB93C47B7CD52C398F6EA77B872FA5EC666941088A1590499AE554FA299B61B83439DCFFEBF56E89A8D7C03C417090F052515CE97C6BA94932511A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........yt......................a.......w.......g......w.......h.......f.......b.....Rich....................PE..d.....G.........."......"...N......................................................=A......................................................d...P...............,....t..H............1...............................................0...............................text............................... ..h.rdata.......0....... ..............@..H.data...\C...@...D...$..............@....pdata..,............h..............@..HINIT....`............j.............. ....rsrc................p..............@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\video_driver\x64\is-DG52H.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):65520
                                                                                        Entropy (8bit):6.707645180597379
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:fZ0VsKqTDSO+Svm+ldunI1Z2Aqf5VUValkjndO2muVUValkjVX20nc1HPWVEV3GZ:f+qR+RXNhqs2nNqseX9cuOEQ6R
                                                                                        MD5:398931E2E5D0500F211648A67468AEA5
                                                                                        SHA1:EF5310DAF008705FAA3A10A7424C6BED0B13EE0D
                                                                                        SHA-256:8239B9C6B9E2FDD395D488B3E5AA0FF96A8E9B3F94F644FCF7051A47F2D72130
                                                                                        SHA-512:B2D1312735722E236AABB0BFD3007C2D0661DE11D2130674F313A4B0F9946B48D10F0E7DEFD8208EBC7EC20AC4A5BB97C5535DC99B1BF0C9B6794B3BBDA18F7A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.....s...s...s...r.:.s.n,....s.?w....s.?w....s.n,....s.?w....s.?w....s.?w....s.Rich..s.........................PE..d.....G.........." .....f...........o..........................................................................................................(........................}......,....................................................................................text....a.......b.................. ..h.rdata...............f..............@..H.data................n..............@....pdata...............r..............@..HINIT.................x.............. ....rsrc................|..............@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\video_driver\x64\is-PCJE3.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):64584
                                                                                        Entropy (8bit):6.217578252848295
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:n2rTNK12/kvuSZinAIyxNwsqfFVUValkj7zJ20nc1HGVEV3GPkjtP2gbVUValkjb:2ai+xNwhNqs+l9cmOEmeOqsc
                                                                                        MD5:62A9F1A11D646A04527E02C5A23F5DF4
                                                                                        SHA1:91FD156321742014C103B13196819DDB8E119CA9
                                                                                        SHA-256:6062739682C36A04785FA20D234C9903F82C7CD3EEE3508E9B047156FAF3F3CA
                                                                                        SHA-512:CA9A0FB916AB93C47B7CD52C398F6EA77B872FA5EC666941088A1590499AE554FA299B61B83439DCFFEBF56E89A8D7C03C417090F052515CE97C6BA94932511A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........yt......................a.......w.......g......w.......h.......f.......b.....Rich....................PE..d.....G.........."......"...N......................................................=A......................................................d...P...............,....t..H............1...............................................0...............................text............................... ..h.rdata.......0....... ..............@..H.data...\C...@...D...$..............@....pdata..,............h..............@..HINIT....`............j.............. ....rsrc................p..............@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files\USM USB Display\video_driver\x86\dfmirage.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):58480
                                                                                        Entropy (8bit):7.101832674821119
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:M5n/+IE+lNHyx8voym9IVlKG9EqwO3eGtpY9u2w2qfkolVUValkjQ2mEVUValkj0:XxAjddmwvsolqsc7qsQ9c0OEcHn
                                                                                        MD5:F06F9FF1CFE6EC762A956AE9523880BE
                                                                                        SHA1:161FB9F0E173F23B37A886A4FCBDBBC83E3926D5
                                                                                        SHA-256:5DEFD0DB776E6CB3EFCE0738727A2FA547C1E181D7269E0E488A937779578E5C
                                                                                        SHA-512:72BA5F1046C58EDCB93E6703AF182D51E1C5696CD505F3A70219E012ECEE8480F11540B0BBA990E1AA6A5867F2BAE523381361BE27FD63790819F02591E9648F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$..........................................................................................................................................................................................................................................................................................................................................................................................................@...@...@...L...B...gu..B...@...b.......C...gu..C...gu..O...gu..A...gu..A...Rich@...........................PE..L.....G...........!.....T...........L.......U...............................f...............................................[..(...._...............f...}...c.......U...............................................U...............................text...@P.......P.................. ..h.rdata.......U.......U..............@..H.data........Z.......Z..............@...INIT....

                                                                                        C:\Program Files\USM USB Display\video_driver\x86\dfmirage.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):62280
                                                                                        Entropy (8bit):6.348799184399525
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:YGwNK12/kvuSZinAIyxNLCwrqf1PVUValkjj20nc1HpVEV3GPkjK2gxVUValkjlY:Pi+xN32dPqsc9cJOEQoqsaY
                                                                                        MD5:5FE3575C80ECA039888098C25B2CEA33
                                                                                        SHA1:A630387ED134F1BC608F3458C55AAD73A5131C7D
                                                                                        SHA-256:2E226C7EAA0D94D7FB99BF2FF86C0C6DD82774C0B45B66323A4EE8F9AD818343
                                                                                        SHA-512:119EE41FB04CD4A491FB545840614848D4BB359FF77E90F4C2FBE1959A1C15A6E7AF346686902E662F6624BAE9CB9AAF6D03818EED1CE74F16F97054AAA37407
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................P...>...>...>..6C...>...?...>...-...>..6S...>..6P...>..6B...>..6F...>.Rich..>.................PE..L.....G.....................J.......a.......................................k......22......................................La..P....e...............k..H....i..(... ...............................@...@............................................text............................... ..h.rdata..............................@..H.data...\B.......B..................@...INIT.........a.......a..

                                                                                        C:\Program Files\USM USB Display\video_driver\x86\is-0RNM6.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (DLL) (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):58480
                                                                                        Entropy (8bit):7.101832674821119
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:M5n/+IE+lNHyx8voym9IVlKG9EqwO3eGtpY9u2w2qfkolVUValkjQ2mEVUValkj0:XxAjddmwvsolqsc7qsQ9c0OEcHn
                                                                                        MD5:F06F9FF1CFE6EC762A956AE9523880BE
                                                                                        SHA1:161FB9F0E173F23B37A886A4FCBDBBC83E3926D5
                                                                                        SHA-256:5DEFD0DB776E6CB3EFCE0738727A2FA547C1E181D7269E0E488A937779578E5C
                                                                                        SHA-512:72BA5F1046C58EDCB93E6703AF182D51E1C5696CD505F3A70219E012ECEE8480F11540B0BBA990E1AA6A5867F2BAE523381361BE27FD63790819F02591E9648F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$..........................................................................................................................................................................................................................................................................................................................................................................................................@...@...@...L...B...gu..B...@...b.......C...gu..C...gu..O...gu..A...gu..A...Rich@...........................PE..L.....G...........!.....T...........L.......U...............................f...............................................[..(...._...............f...}...c.......U...............................................U...............................text...@P.......P.................. ..h.rdata.......U.......U..............@..H.data........Z.......Z..............@...INIT....

                                                                                        C:\Program Files\USM USB Display\video_driver\x86\is-H235T.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):62280
                                                                                        Entropy (8bit):6.348799184399525
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:YGwNK12/kvuSZinAIyxNLCwrqf1PVUValkjj20nc1HpVEV3GPkjK2gxVUValkjlY:Pi+xN32dPqsc9cJOEQoqsaY
                                                                                        MD5:5FE3575C80ECA039888098C25B2CEA33
                                                                                        SHA1:A630387ED134F1BC608F3458C55AAD73A5131C7D
                                                                                        SHA-256:2E226C7EAA0D94D7FB99BF2FF86C0C6DD82774C0B45B66323A4EE8F9AD818343
                                                                                        SHA-512:119EE41FB04CD4A491FB545840614848D4BB359FF77E90F4C2FBE1959A1C15A6E7AF346686902E662F6624BAE9CB9AAF6D03818EED1CE74F16F97054AAA37407
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................P...>...>...>..6C...>...?...>...-...>..6S...>..6P...>..6B...>..6F...>.Rich..>.................PE..L.....G.....................J.......a.......................................k......22......................................La..P....e...............k..H....i..(... ...............................@...@............................................text............................... ..h.rdata..............................@..H.data...\B.......B..................@...INIT.........a.......a..

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:Extensible storage engine DataBase, version 0x620, checksum 0x211ae182, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                        Category:dropped
                                                                                        Size (bytes):786432
                                                                                        Entropy (8bit):0.25077541626065186
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:k+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:bSB2nSB2RSjlK/+mLesOj1J2
                                                                                        MD5:2A698330CD974CA0DB4759EA2059CD0D
                                                                                        SHA1:28453BD148EDE45BCFB75E7E71BE272E20C5A640
                                                                                        SHA-256:C73E21CF6CBF6EE8BE707510AC954672357FB9DB09DB1C1458DA8D47D0231451
                                                                                        SHA-512:BD21BF1917160AB426FA769EFF43A90FACCD099D6BA35B2643FC899A5F8467A278BE38473E7CEC9AD69595607EE1B1AB7C49A363987ADE2D6057FE591F275C95
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:!..... ................e.f.3...w........................&..........w.......z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.........................................................................................................................................................................................................................................:.....z...................b.......z..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USM USB Display\USM USB Display.lnk

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 25 12:18:05 2022, mtime=Mon Jul 25 12:18:05 2022, atime=Mon Jun 13 14:10:26 2022, length=1493504, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):945
                                                                                        Entropy (8bit):4.561699380712046
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:8mx7WrdfDr/yjo3VQAPoftR1jdBCdUBm:8m6dKoFPUt/jdUdW
                                                                                        MD5:D9B6C271D97A76B1F7726F854FCB1BC2
                                                                                        SHA1:2CF0A640CB66E4469D11E5F51146C44BFC695B02
                                                                                        SHA-256:638134E9C5E0419A71DEF3C7149620B1E9F093A16952692C20528F6F8A3E1AB1
                                                                                        SHA-512:2274327C06D49FCDA389626F3AB3D0790188CEB866CA0839F2022B4D727C5C846B499CA438707BECCE89D30242FA08749114964516DC4DDD580219FEC7C1B6DA
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.... ....W..(.......(......7................................P.O. .:i.....+00.../C:\.....................1.....>Q.;..PROGRA~1..t......L.hT`M....E...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1......TEj..USMUSB~1..P.......TCj.TEj.....W.....................l..U.S.M. .U.S.B. .D.i.s.p.l.a.y.....p.2......TMy .WINUSB~1.EXE..T.......TCj.TCj.....X........................W.i.n.U.s.b.D.i.s.p.l.a.y...e.x.e.......a...............-.......`.............1a.....C:\Program Files\USM USB Display\WinUsbDisplay.exe..A.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.\.W.i.n.U.s.b.D.i.s.p.l.a.y...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.`.......X.......405464...........!a..%.H.VZAj...n-$.............!a..%.H.VZAj...n-$............E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

                                                                                        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USM USB Display\Uninstall USM USB Display.lnk

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 25 12:18:05 2022, mtime=Mon Jul 25 12:18:05 2022, atime=Mon Jul 25 12:17:51 2022, length=3224637, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):920
                                                                                        Entropy (8bit):4.5965738125211635
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:8mQsB00YXE1hYLoKxdpF4sXdr//ZfMBGFodvsjACofvbdpsIvBbdpsI0nhbBm:8mFGtLoqdfNr/BwBVoACofDd3Nd8Bm
                                                                                        MD5:DAC6449D4C99374C5A70B0C30D1156BA
                                                                                        SHA1:E7873E7D550E588C01FD16B1156F5ACC0A774DD5
                                                                                        SHA-256:FB3F98FA190E581FEBF7E11F0DEE3B343BDB5A33CD791257074BDAB31DCB9892
                                                                                        SHA-512:E97F2D8917906AFE7CD44F0BF646B338FA5637B7A67D2043C16ACF5233E5827B0E4041AB5322FFCA6D3254962030DD3035F8DE86F61A4C71B59468F58049550E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.... .......(...N...(...)...(...=41..........................P.O. .:i.....+00.../C:\.....................1......TCj..PROGRA~1..t......L..TNj....E...............J.....[.W.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1......TKj..USMUSB~1..P.......TCj.TNj.....W........................U.S.M. .U.S.B. .D.i.s.p.l.a.y.....f.2.=41..T:j .unins000.exe..J.......TCj.TCj.....X........................u.n.i.n.s.0.0.0...e.x.e.......\...............-.......[.............1a.....C:\Program Files\USM USB Display\unins000.exe..<.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.\.u.n.i.n.s.0.0.0...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.`.......X.......405464...........!a..%.H.VZAj...u-$.............!a..%.H.VZAj...u-$............E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

                                                                                        C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3200512
                                                                                        Entropy (8bit):6.382064662276745
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:CEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVB33384:C92bz2Eb6pd7B6bAGx7/333T
                                                                                        MD5:3656DEEFA846EB33067D66B624232474
                                                                                        SHA1:65AD21C7581F09448C6C0EC812CC728AE22DFABA
                                                                                        SHA-256:BB181EF25D05ADB3D5FFFCBADB3BF3696EF27DACD2356C29E043726F9BA50083
                                                                                        SHA-512:6836527F940CCCDC13F382BE1A1CF375FAA0563DB63FA48DA1C47F347740E6AFA241FE4C009712C18DF5839F4C0E65E5B1DFC90AFBE1B00E6937CE8C88099F4B
                                                                                        Malicious:true
                                                                                        Reputation:low
                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...(..`.................:,.........`F,......P,...@...........................1...........@......@....................-......p-.29....-.......................................................-......................y-.......-......................text.....,.......,................. ..`.itext...(... ,..*....,............. ..`.data........P,......>,.............@....bss.....y....,..........................idata..29...p-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@..............1.......0.............@..@........................................................

                                                                                        C:\Users\user\AppData\Local\Temp\is-T5EMD.tmp\_isetup\_setup64.tmp

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):6144
                                                                                        Entropy (8bit):4.720366600008286
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\IndirectDisplayBus.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\SET1FD0.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\SET2261.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\x64\IndirectDisplayBus.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\x64\SET1E77.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\SET143D.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\SET1595.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET12A5.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\SET75A.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\libusb0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\amd64\libusb0.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\x86\SET1884.tmp

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\x86\libusb0_x86.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\USM USB Display.lnk

                                                                                        Download File
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 25 12:18:05 2022, mtime=Mon Jul 25 12:18:05 2022, atime=Mon Jun 13 14:10:26 2022, length=1493504, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):951
                                                                                        Entropy (8bit):4.553925175514026
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:8mxwLoqdfNr/B7o3VQAPoftR1CdBCdUBm:8mlqdroFPUt/CdUdW
                                                                                        MD5:D4F2929BC96C291A35DFA88DFFA689E0
                                                                                        SHA1:830BD627F67E5D452700534DC02BE51190621823
                                                                                        SHA-256:5C106A55A9DF660A0C170D4ABEDC32795F12BC867A536E335E9FF2EAAC0CF777
                                                                                        SHA-512:D90C1BB5620EA3D61837B01E24A596122C4998A2CA2A2E56B747CA754979BDEF341001206455BA56475FE19AC34494E7E88127EF20BCCFC5CB0A9B5533D61BE0
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.... ....W..(.......(......7................................P.O. .:i.....+00.../C:\.....................1......TCj..PROGRA~1..t......L..TNj....E...............J.....[.W.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1......TKj..USMUSB~1..P.......TCj.TNj.....W........................U.S.M. .U.S.B. .D.i.s.p.l.a.y.....p.2......TMy .WINUSB~1.EXE..T.......TCj.TCj.....X........................W.i.n.U.s.b.D.i.s.p.l.a.y...e.x.e.......a...............-.......`.............1a.....C:\Program Files\USM USB Display\WinUsbDisplay.exe..D.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.\.W.i.n.U.s.b.D.i.s.p.l.a.y...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.S.M. .U.S.B. .D.i.s.p.l.a.y.`.......X.......405464...........!a..%.H.VZAj...n-$.............!a..%.H.VZAj...n-$............E.......9...1SPS..mD..pH.H@..=x.....h....H......K*..@.A..7sFJ............

                                                                                        C:\Users\user\Desktop\cmdline.out

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):6237
                                                                                        Entropy (8bit):3.0096374432260578
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:WNrqLDkeiJ0rqdJ0rqLTxxxW6kbOrqG16Q5nGlf0eeVUWiYL4EyLwX9V6KCKbOrK:4EEVUWiaXyLgDHj
                                                                                        MD5:97B741A558B79615461559FB3DB5B1A7
                                                                                        SHA1:DF810FB5629C46C3FE5DC80C8AB451F37AB0AFAB
                                                                                        SHA-256:BA682CDDDEB3543FEA593ABA1BF04DD2E5A7015FA4C3D704DD98551EE5FEC596
                                                                                        SHA-512:A85E5580512A2ECD81973E4C9255AC71F616F75B487318745ABF155C0FF0F2BD4EBC7F44ED6C105155BB2BAE07A862B84BEED29C1BBA48E1E8AFF0869880A87D
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:--2022-07-25 15:17:41-- https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe..Resolving github.com (github.com)... 140.82.121.3..Connecting to github.com (github.com)|140.82.121.3|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe [following]..--2022-07-25 15:17:41-- https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe..Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.109.133, 185.199.110.133, .....Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 3411586 (3.3M) [application/octet-stream]..Saving to: 'C:/Users/user/Desktop/download/MSDisplay_Windows_V2.0.1.7.3.exe'.... 0K .......... .......... .......... .......... ....

                                                                                        C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\wget.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3411586
                                                                                        Entropy (8bit):7.807278968332977
                                                                                        Encrypted:false
                                                                                        SSDEEP:98304:1SiOZA6Qt4iHcpmjVdTL8Bs+ba+46pratD8Qcf:eiHcQVdX82i5rxQcf
                                                                                        MD5:44B238973B55B2D863BC8608140AF84D
                                                                                        SHA1:598B1428A52E61ABEBCFEBCC3E7FC991F35837B9
                                                                                        SHA-256:4C0008A6DA0B5BEAA05F3AB33E822FD49FBF581BB3235FD4279743048DDEB927
                                                                                        SHA-512:0E35B4B5446349F2237EEF6D206AB75426EA368C50F9377811909740D3AAD5CDAFDC61CFAF8EA0D28ACD43F19D59245A10823D7900E58EDE6F805CB1473D7BDD
                                                                                        Malicious:true
                                                                                        Reputation:low
                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...'..`.................P...........^.......p....@.......................................@......@...................@....... ..6....p.......................................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                                        C:\Windows\INF\oem3.inf

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Windows\INF\setupapi.dev.log

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):31254
                                                                                        Entropy (8bit):5.278104287581788
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:0Vjun0aJankfJe4Om3VYO3VvmJHujUP7Wig2SlPsRwS11UtdJLJSjv:66nUMOm3VYO3VvmJHu2glPqwrtd/Sr
                                                                                        MD5:738400B2DDB4A8D5E3E8FA26E0096124
                                                                                        SHA1:FA9CDE5BA49F260785F11DA5DD5F5C865464C47D
                                                                                        SHA-256:CBCD97CB67FE5835397BD322D1FD5AEC95200853E0D940BBEF4390E23D912D30
                                                                                        SHA-512:E3DC103368A3DF70B94DDF9BE9E4D85AF75021EF1969EB1FA718A656A0B968A931C21404DEB6647126C6E78902A7CCD81B2396E1D3C6F4E236FC2D502E1FEC9A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:[Device Install Log].. OS Version = 10.0.17134.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2019/06/27 07:49:05.498]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2019/06/27 07:51:20.856.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.17134.1.. inf: Catalog File: prnms009.cat.. pol: {Driver package policy check} 07:51:20.903.. pol: {Driver package policy check - exit(0x00000000)} 07:51:20.903.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 07:51:20.903.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 07:51:20.919.. inf: Driver package 'prnms009.Inf' is

                                                                                        C:\Windows\Logs\waasmedic\waasmedic.20220725_131816_941.etl

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):8192
                                                                                        Entropy (8bit):2.742080981765348
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:+1zjr52D3b7kU9b7kEefb7klRb7k9Mb7kbIl9lBb7k0tplHb7kvb7kQ3jb7kwSbH:Cp2j0U90X0709M0U9b0ClH0v0Qz0h09O
                                                                                        MD5:E9BFA22149C78D9438C3E401283C8182
                                                                                        SHA1:104A5EDBBF5EE78F76003F60B7068DD51E0C36D9
                                                                                        SHA-256:9B6495685F23F0B89F36A0FF5DE0A2F6B3576D7C4EDA9B6D0749C66C0504A1DB
                                                                                        SHA-512:7886A5B8C20907D9B6AEDC880456E8ED7EFBC154ED131FC408659F835CD454AA477DCEB6E27B5D6BB6B63DC8BEB2CED024E121D3E22240F6B02F4C8E6736BA68
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:....................................................!...........................`...|....R.......................B.......rf$)...Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1.............................................................#..2.... .....q..)...........E.C.C.B.1.7.5.F.-.1.E.B.2.-.4.3.D.A.-.B.F.B.5.-.A.8.D.5.8.A.4.0.A.4.D.7...C.:.\.W.i.n.d.o.w.s.\.l.o.g.s.\.w.a.a.s.m.e.d.i.c.\.w.a.a.s.m.e.d.i.c...2.0.2.2.0.7.2.5._.1.3.1.8.1.6._.9.4.1...e.t.l.............P.P.`...|....R..................................................................9.B..R......17134.1.amd64fre.rs4_release.180410-1804............5.@..R......OYo."(.s..O........WaaSMedicSvc.pdb............................................................................................................................................................................................................................

                                                                                        C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):55
                                                                                        Entropy (8bit):4.306461250274409
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                        MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                        SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                        SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                        SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                        C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

                                                                                        Download File
                                                                                        Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):10844
                                                                                        Entropy (8bit):3.16220684648921
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:cY+38+DJM+i2Jt+iDQ+yw+f0+rU+0Jtk+EOtF+E7tC+Ewt+S:j+s+i+Z+z+B+c+Y+0g+J+j+p+S
                                                                                        MD5:7D7B66631490B39E2E7AA3D2B03B4BC7
                                                                                        SHA1:CBB0C9656761A5AC7A911CEE1D26BF02E8BBC5FD
                                                                                        SHA-256:106DE0D0F49C2B7D6B3DED1FE6FA8432D47D508F2CAA162D11A53D8C8F7F2A8D
                                                                                        SHA-512:FA135054DC3DCDC87695332CF3A87F1D40A4F28DC0CE90813D525D453F51945649BC0FAD113AAB8A5F56A5D92C3908EB333EBB841C9B94C9F0C6A7F968A8AB83
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\MSUSBDisplay.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\MSUSBDisplay.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\SET2FC4.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):12522
                                                                                        Entropy (8bit):7.202170699428129
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:jMKuxuRsWurR4vz4vUyWjdqygWOL7yKnUi8rFWQF5PW4q2OEU+9YX01k9z3AlcRB:jYl94jsk4CFRb+4q2OQGR9zOQB
                                                                                        MD5:2257A33A42E1EE747DCC004A37E25F43
                                                                                        SHA1:5257F69C94512F5829FEAC902EF7AC4CA390B059
                                                                                        SHA-256:30A6694CE36620E9AAA344FBFBC2184439202850994BF23862907C9901A8BBDE
                                                                                        SHA-512:CE17CEA804C48CC39ACBBB7BF72537904C7AD034C15668916F278749DE303F9CED965BB8F1610A5DC633F8D248A347B64D80BD245619F0B6F0F398B8C9D46AA9
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7......3.h1.B..K.m.'...220620064805Z0...+.....7.....0..h0.....T`......=.R..Pd!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... ).imS..;.. .<..@.t..YB.`Wi+...y.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ).imS..;.. .<..@.t..YB.`Wi+...y.0....G(....Ur..Y<%.#...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."m.s.u.s.b.d.i.s.p.l.a.y...i.n.f...0....v.c..:.>.....r.Y.. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........l.i.b.u.s.b.0...d.l.l...0.... .....8\.k.`.]C..m.`.x.{..1....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\SET3226.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:Windows setup INFormation, ASCII text
                                                                                        Category:dropped
                                                                                        Size (bytes):4595
                                                                                        Entropy (8bit):5.118142736620839
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:xEwuBea4X8ONsosEmCiLAD3b2FHnLaZ0jlKhhIMA7YIdPr7o/2XNsTcsD61j6DmP:x/MmN7sSiLUK5nLaZ0jUFCZi29vUm1+y
                                                                                        MD5:8409065E196B560A91F56FA5A2A20FA5
                                                                                        SHA1:4728D9D38192C05572F30F593C25F72389D9D5B2
                                                                                        SHA-256:CC2A529C0D9ECD732810D84FF4BD4E68C6C9A9F3252EA000A1CB9F27AF822EE5
                                                                                        SHA-512:6A3DD8CF607EB57D32C5815E37DC740119D15F7C519B9DBA6EFAB6E54BEA5F1871D42B90DDC119419A0157B416B25CC25A73C9E9C2903AF87BAC6F7B86AE46C8
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:; MSUSBDisplay.inf.; Copyright (c) 2010 libusb (GNU LGPL).;.;--------------------------------------------------------------------------.; libusb-win32 (Strings).;--------------------------------------------------------------------------.[Strings].DeviceName = "MS USB Display".VendorName = "MS".SourceName = "MS USB Display Install Disk".DeviceID = "VID_534D&PID_6021&MI_03".DeviceID1 = "VID_345F&PID_9132&MI_03".DeviceGUID = "{e3fc78a8-c15c-4955-accd-a73f3eba1639}"..;--------------------------------------------------------------------------.; libusb-win32 (Version / ClassInstall32 / Manufacturer).;--------------------------------------------------------------------------.[Version].Signature = "$Windows NT$".Class = "MSDisplay".ClassGUID = {FB781AAF-9C70-4523-A5DF-642A87ECA567}.Provider = %VendorName%.CatalogFile = MSUSBDisplay.cat.DriverVer = 06/17/2022, 1.0.0.2..[ClassInstall32].Addreg = libusb_class_install_add_reg..[libusb_class_install_add_reg].HKR,,,0,"MSDisplay".H

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2BDA.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\SET2D71.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):88064
                                                                                        Entropy (8bit):6.7099958191047175
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Y4Uu3aj7mZPts/HJG/S9tD059hndca0vnFnNazNN0k9c0P0k+:Y1u3aHmZPqJD0zhnOa0vFNa70krP0l
                                                                                        MD5:63BD4F68532685EFC0766CF99C3B64AB
                                                                                        SHA1:5B39EB70EF83D0FB1C7ED87BE2652134D8714BE7
                                                                                        SHA-256:46FC45EDEA79B04B4CED15C2A4340914E6861FBAC82AFD98D9F5F969AC6193BF
                                                                                        SHA-512:A2F519424307969970D4729D0A94FB87C9DD16C9B0F969E50D6E734ECA3E35835DAF311CD0A8B047F9362F9255A348D7C855904FD97D983204EAE69DB6834879
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u...&...&...&.0.&...&.k.&...&.k.&...&.k.&...&...&L..&.k.&...&.0.&...&.k.&...&.k.&...&.k.&...&.k.&...&.k.&...&Rich...&........................PE..d....X.L.........." ................l.........@..............................P............@.............................................q............0....... ...........R...@.......................................................................................text...q........................... ..`.data...............................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\amd64\libusb0.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):56320
                                                                                        Entropy (8bit):6.879881545726585
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:QNba+bwO+WXGNNn+5VCdDHFcA32MMacmnKxLVNe9zL20nc1ucwV1VaXLkjN:QpXCpFc4/MacmnKnNazL9ckP0E
                                                                                        MD5:215CEE5C0398656FCA936BF3D33B1D3E
                                                                                        SHA1:4993B6CF8B70335C01C3E23EF8EFD4DB4B178AE9
                                                                                        SHA-256:35150E620692F292D525944EF4C9CEF7E3E3673AB2D50052730E37715F8FC02B
                                                                                        SHA-512:B4C9D2448C3AA915060F6E37DFF9F1F7EDE3216BB60F7FFD826E100B602C8F4C7B44C847E7B582A82207C10481B519FA6EDA5BF1E65E592BB90EDFB1FFC849B2
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i..i..i..h..i..?...i..?...i.d...i.d...i..?...i.d...i.d...i.d...i.Rich..i.................PE..d....Y.L.........."......t.......................................................... .......................................................d...<...............|........R......4...p...................................................p............................text....m.......n.................. ..h.rdata...............r..............@..H.data................x..............@....pdata..|............z..............@..HINIT.................~.............. ....rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\SET34A8.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{d70890be-694f-7c4d-b1c9-fea5da3fc6f2}\x86\libusb0_x86.dll (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):79880
                                                                                        Entropy (8bit):6.938075643480483
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Ry9hmU73cXNX2lXKSabMpgoPnD2f1MW05ag1nf+zw9c1P0g:RQmUuXYWMprC05Z1f+8OP0g
                                                                                        MD5:7054D351F427572D9403F6799C314420
                                                                                        SHA1:EC80076FF1DB6F7F56577FFD573179DCB2FFBC9A
                                                                                        SHA-256:ED555FC18C5A9054C98D1F73B16CC89B7C70DCE0962F1AD0817F2F1EB227ED15
                                                                                        SHA-512:3068E396B37AC3E38DDCC92065A70C0C914AE2F03F449F155734F2F28B02D9CF06C7265248D6BA7708C0DF80CF20B1709E5FC365733EC0C86AD54C310152E475
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l2&.(SH.(SH.(SH.qp[."SH...5./SH.(SI..SH...3.+SH...&.'SH...2.)SH...%.mSH...6.)SH...4.)SH...0.)SH.Rich(SH.................PE..L....X.L...........!........."....................@.......................................@.........................`...q...L............................R...........................................6..@...............l............................text............................... ..`.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\IndirectDisplayBus.cat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\SET351D.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):11371
                                                                                        Entropy (8bit):7.165425948476642
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:x4ksmbF89MJCOs39JnxrEwJqKkhYCzFUtpwBqnajr2szK:c4FXNGJxXxkh3sqlGszK
                                                                                        MD5:AB04B978A378FB420900C933DDB1223C
                                                                                        SHA1:BBE1A47B005C19D3B231CC87ED94763A54FC6A1D
                                                                                        SHA-256:E50CACA48A385F73AA1D1A36905616FE2A2767EA457D793E718C7AF323AA82DA
                                                                                        SHA-512:3A050824CA848AA801722E00428ED0DC86D3CC5585C7A0C14BB89344BB82DB0AF71A8B4988BC8CCD6AD78CC5CB37106B69264C970E580C05805D1F92EE827AEB
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:0.,g..*.H........,X0.,T...1.0...`.H.e......0.....+.....7......0...0...+.....7........#BG.C.zK..'..190917090926Z0...+.....7.....0...0.... .)`.#]...2.V...g,/.s....3"-....p1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .)`.#]...2.V...g,/.s....3"-....p0....M%..r09.EA.q..m.Jr..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0.... `v.b..]}...v...........M3c.B..31..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `v.b..]}...v...........M3c.B..30.... ...|M..S.o....,...:..u.U. ..a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\SET37DD.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\indirectdisplaybus.inf (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:Windows setup INFormation, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5180
                                                                                        Entropy (8bit):3.6771151892091862
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:wL6dlYXal8lhi4GTFXHZl9lnl615DboEqiEqY3hmeML6Qx9MxVXVp1D1XllIRwR2:wL6dlGBGBZHNmBBiXJRfuYg
                                                                                        MD5:178FA611C571BA987D07DC96A461DD26
                                                                                        SHA1:FD79052547A1A9CD0B957CB39D32888EB46408E1
                                                                                        SHA-256:1829607F235DA2D801329F56939FAD672C2F8873E3FFC90E33222DA80DA30570
                                                                                        SHA-512:97AF898AB0BCAE4C4F3CA5D7E8CD4175AB8253782BC3F5D94CBBB9E0E44E921820171338230DA747AA40C6A91032564E48552278F07105331EFAB471E3F13D3F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..;./.*.+.+.....;.....;.C.o.p.y.r.i.g.h.t. .(.c.). .1.9.9.0.-.1.9.9.9. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n. .A.l.l. .r.i.g.h.t.s. .R.e.s.e.r.v.e.d.....;.....;.M.o.d.u.l.e. .N.a.m.e.:.....;.....;. . . . .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...I.N.F.....;.....;.A.b.s.t.r.a.c.t.:.....;. . . . .I.N.F. .f.i.l.e. .f.o.r. .i.n.s.t.a.l.l.i.n.g. .t.o.a.s.t.e.r. .b.u.s. .e.n.u.m.e.r.a.t.o.r. .d.r.i.v.e.r.....;.....;.I.n.s.t.a.l.l.a.t.i.o.n. .N.o.t.e.s.:.....;. . . . .U.s.i.n.g. .D.e.v.c.o.n.:. .T.y.p.e. .".d.e.v.c.o.n. .i.n.s.t.a.l.l. .i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s...i.n.f. .r.o.o.t.\.i.n.d.i.r.e.c.t.d.i.s.p.l.a.y.b.u.s.". .t.o. .i.n.s.t.a.l.l.....;.....;.-.-.*./.....[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.I.N.D.O.W.S. .N.T.$.".....C.l.a.s.s.=.S.y.s.t.e.m.....C.l.a.s.s.G.u.i.d.=.{.4.D.3.6.E.9.7.D.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....D.r.i.v.e.r.V.e.r. .=. .0.9./.0.5./.2.0.1.9.,.1.0...4.9...3.1.

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\IndirectDisplayBus.sys (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Windows\System32\DriverStore\Temp\{f81f5b17-e881-1845-ad99-3f74956ffa07}\x64\SET3328.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):25592
                                                                                        Entropy (8bit):6.445554864082489
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:KmA+znGE0CfBf9mXGLcMIeUFitacK2TeJxXxkh36qlG:KAn5lJ9mdiyJxh63
                                                                                        MD5:AB54EBBCB994C461CCD00DF6012C979B
                                                                                        SHA1:6BEB75137C7D27CAAF41202467FC1036BC4D140D
                                                                                        SHA-256:8519B438E73E6858B4CE56815F4E287325A35BF184F180BF196501EE457D92C9
                                                                                        SHA-512:6E00CC524E5897040C2503EAC4112FF538F3A5EF5AA6FBEF2457A3178A84F1885478E2C0598FFFC90118D9FC6AB68FBC120B6699A407313693BD5290C70902DC
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..c...c...c..e...c..f...c..d...c...b...c..b...c..g...c..`...c...g...c.......c...a...c.Rich..c.........................PE..d.....].........."......$.....................@....................................[.....`A.................................................p..<............P.......@...#......,....1..8............................1...............0..H............................text...0........................... ..h.rdata.......0......................@..H.data...8....@....... ..............@....pdata.......P......."..............@..HPAGE.........`.......$.............. ..`INIT.........p.......2.............. ..b.rsrc................4..............@..B.reloc..,............>..............@..B................................................................................................................................................................

                                                                                        C:\Windows\System32\catroot2\dberr.txt

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\drvinst.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):4540
                                                                                        Entropy (8bit):5.32822892832225
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:k6G+0B9j0GRX0l7lmE10YVVCEvVV7lmE9CE97lmEgSrCEgSr7lmEfCEf7lmEYCEG:k6GNf4G6Z/VNVxPnpUWQ2FkWoMe1w
                                                                                        MD5:3EF1B10B95DB2B0D41B650BF8DCA5CB6
                                                                                        SHA1:A2EDC23F7F6608AFAC75164169AA361596610705
                                                                                        SHA-256:26A65FCD97FF59C3141FB8371965688B7070C4249CDEE0B34C204D9CD3240789
                                                                                        SHA-512:F4D31F0F0A80A84328476CDD0E9F553091E9C458AC5AB965DCF9A3F974E3B31DCD94898EA51B4CBA9EFB754B254D33DA43D41DA18638A13B99AC460D826DE73E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:CatalogDB: 7:51:21 AM 6/27/2019: DONE Adding Catalog File (125ms): oem0.cat..CatalogDB: 7:51:21 AM 6/27/2019: DONE Adding Catalog File (16ms): oem1.cat..CatalogDB: 12:56:50 AM 6/27/2019: DONE Adding Catalog File (359ms): Microsoft-Windows-NetFx3-OnDemand-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat..CatalogDB: 12:56:50 AM 6/27/2019: DONE Adding Catalog File (250ms): Microsoft-Windows-NetFx2-OC-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat..CatalogDB: 12:56:50 AM 6/27/2019: DONE Adding Catalog File (31ms): Microsoft-Windows-Presentation-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat..CatalogDB: 1:23:49 AM 6/27/2019: Init:: Database previously shutdown dirty C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb..CatalogDB: 3:02:27 AM 7/23/2020: DONE Adding Catalog File (125ms): oem2.cat..CatalogDB: 3:27:01 AM 7/23/2020: Init:: Database previously shutdown dirty C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb..CatalogDB: 3:27:01 AM

                                                                                        \Device\ConDrv

                                                                                        Download File
                                                                                        Process:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):203
                                                                                        Entropy (8bit):4.641803693953192
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:V8iJiRgOBLU3ACX4KR5XjT11RoFnRAHUe:V8iJiT9QACXvjh1RofAHUe
                                                                                        MD5:662BD8DF5FFF59D22681FDE9A7586406
                                                                                        SHA1:1C18F70C1311424A563A13D49A3BE7CAC60B2FC8
                                                                                        SHA-256:22DCB707A3E3353BC27C3A094A45F9C848D5B7018BCA00B7109EE81993D195E6
                                                                                        SHA-512:2A6B031114836F31FEC55F9812BF6F68EC473F2B4A721BB9CD45896399E10FFAAFFECFF73973515DD13141CD7BB576FB82E1F6FBECF6FE61FB1ABBDAFD42B41F
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:Device node created. Install is complete when drivers are installed.....Updating drivers for root\IndirectDisplayBus from C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.inf...

                                                                                        Static File Info

                                                                                        ⊘No static file info

                                                                                        Network Behavior

                                                                                        Network Port Distribution

                                                                                        TCP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Jul 25, 2022 15:17:41.378979921 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.379034996 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.379134893 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.384830952 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.384864092 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.430195093 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.430289984 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.433569908 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.433581114 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.433795929 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.451391935 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.492517948 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.934645891 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.934845924 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.934923887 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.934933901 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:41.934993982 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.953191996 CEST49738443192.168.2.4140.82.121.3
                                                                                        Jul 25, 2022 15:17:41.953223944 CEST44349738140.82.121.3192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.081947088 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.082010031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.082110882 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.086863041 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.086885929 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.136735916 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.136867046 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.138775110 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.138801098 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.139116049 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.156682014 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.200587034 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525310993 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525437117 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525501966 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525507927 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.525549889 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525609970 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.525621891 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525644064 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525695086 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.525717974 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525942087 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.525993109 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.526007891 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.526027918 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.526076078 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.526094913 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.526998997 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.527127981 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.527152061 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.527327061 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.527396917 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.527414083 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.527823925 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.527905941 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.527928114 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.528270006 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.528337002 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.528357029 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.528920889 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.528996944 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.529017925 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.529159069 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.529226065 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.529242039 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.529827118 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.529886007 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.529906034 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.530550957 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.530616999 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.530638933 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.530798912 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.530858040 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.530874014 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.541546106 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.541688919 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.541723967 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.541753054 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.541816950 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.541914940 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.542217016 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.542294979 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.542319059 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.542686939 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.542766094 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.542788982 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543082952 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543145895 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.543169022 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543442011 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543500900 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.543520927 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543790102 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.543869972 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.543893099 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.544101954 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.544174910 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.544193983 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.544637918 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.544720888 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.544745922 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.545814037 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.545885086 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.545907974 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.547147036 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.547214031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.547272921 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.547297955 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.547321081 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.547369003 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.548297882 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.548352957 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.548396111 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.548408031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.548435926 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.557991028 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.560544968 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.560601950 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.560633898 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.560652971 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.560667038 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.562289953 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.562333107 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.562403917 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.562417984 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.562443972 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.563934088 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.563977003 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.564035892 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.564049006 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.564062119 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.564341068 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.564380884 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.564429998 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.564441919 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.564455032 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.572663069 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.572710037 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.572772026 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.572789907 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.572809935 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.574315071 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.574354887 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.574430943 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.574445963 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.574470043 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.574892044 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.574932098 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.574979067 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.574994087 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.575025082 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.576165915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.576206923 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.576251984 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.576266050 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.576278925 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.576877117 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.576921940 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.576971054 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.576994896 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.577008963 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.577014923 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.577797890 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.577856064 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.577888012 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.577904940 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.577934027 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.578341007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.578397036 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.578434944 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.578454971 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.578469992 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.578475952 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.579004049 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579045057 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579087019 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.579102039 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579138041 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.579632044 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579670906 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579735041 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.579747915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.579772949 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.580328941 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.580369949 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.580413103 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.580431938 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.580447912 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.581126928 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581166983 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581218958 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.581233025 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581248045 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.581408024 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581448078 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581475019 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.581491947 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.581513882 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.582294941 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582370043 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582410097 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.582423925 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582448959 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.582652092 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582690001 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582719088 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.582732916 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.582746029 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.590209007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590245962 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590296030 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.590312958 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590332985 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.590646982 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590677023 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590718985 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.590730906 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.590778112 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.591104984 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591135025 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591162920 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.591173887 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591228962 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.591515064 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591542959 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591578960 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.591589928 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.591622114 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.592082024 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592112064 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592164993 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.592176914 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592211008 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.592521906 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592551947 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592582941 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.592596054 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.592616081 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593053102 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593082905 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593111992 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593123913 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593142033 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593413115 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593441963 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593472004 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593483925 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593497038 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593893051 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593919039 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593965054 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.593976974 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.593988895 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.594358921 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.594386101 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.594419956 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.594430923 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.594466925 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.594907999 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.594937086 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.594969034 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.594984055 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.595020056 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.595258951 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.595287085 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.595319986 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.595330954 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.595367908 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.595804930 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.595877886 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.673784018 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.673814058 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.673844099 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.673928022 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.673995972 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734433889 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734462976 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734494925 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734582901 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734601021 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734668016 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734679937 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734704971 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734734058 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734744072 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734828949 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734843016 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734853983 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734883070 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734888077 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734918118 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734956980 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.734977961 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.734998941 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735029936 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735044956 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735057116 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735078096 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735136986 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735147953 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735166073 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735188007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735275030 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735295057 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735316992 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735327005 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735342026 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735410929 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735435963 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735457897 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735467911 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735487938 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735543013 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735554934 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735574007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735601902 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735635042 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735641956 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735671043 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735678911 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735702038 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735726118 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735735893 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735763073 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735773087 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735791922 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735822916 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.735908031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735944986 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.735996962 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736018896 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736035109 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736078978 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736187935 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736216068 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736258030 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736274958 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736294031 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736334085 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736368895 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736394882 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736435890 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736450911 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736488104 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736500025 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736548901 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736581087 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736625910 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736639977 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736656904 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736696005 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736809969 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736841917 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736885071 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736897945 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.736936092 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.736985922 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737010956 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737051010 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737066031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737080097 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737102032 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737122059 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737143040 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737170935 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737274885 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737289906 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737313986 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737335920 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737341881 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737344980 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737359047 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737381935 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737437010 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737504959 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737531900 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737576008 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737591028 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737607002 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737644911 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737685919 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737715960 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737756014 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737771034 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737786055 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737822056 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737852097 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737878084 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737919092 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737934113 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.737950087 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.737987995 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.738013029 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.738073111 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:42.944519997 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.944624901 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.161053896 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.161082983 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.161106110 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.161165953 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.161181927 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.161230087 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.161250114 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.161262035 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.161319017 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171528101 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171551943 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171580076 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171674013 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171689034 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171708107 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171744108 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171760082 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171788931 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171799898 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171818972 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171864033 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171875954 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171895981 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171914101 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171922922 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.171977043 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171987057 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.171998978 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172024965 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172038078 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172061920 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172081947 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172128916 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172158957 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172179937 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172204018 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172291040 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172310114 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172328949 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172348022 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172363997 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172391891 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172450066 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172503948 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172542095 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172559023 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172574997 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172676086 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172697067 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172749996 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172772884 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172801018 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172818899 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172832966 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172848940 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172877073 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172888041 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172924042 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172955990 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.172970057 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.172983885 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173022032 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173042059 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173059940 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173118114 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173141003 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173213005 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173233986 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173254013 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173258066 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173284054 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173321962 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173345089 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173362970 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173379898 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173408031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173446894 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173466921 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173491001 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173527956 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173547029 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173593998 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173616886 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173640013 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173651934 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173677921 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173719883 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173743010 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173759937 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.173798084 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.173860073 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.380520105 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.380625963 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.458611012 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.458637953 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.458659887 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.458729029 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.458798885 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473165035 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473186970 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473217010 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473238945 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473303080 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473320007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473373890 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473386049 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473409891 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473423004 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473433018 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473453999 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473468065 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473474979 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473483086 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473504066 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473530054 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473539114 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473697901 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473711967 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473730087 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473759890 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473772049 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473804951 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473818064 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473825932 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473830938 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473865032 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473900080 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473910093 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473922014 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473934889 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473957062 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.473961115 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.473968983 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474010944 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474037886 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474066973 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474088907 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474148035 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474172115 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474201918 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474215031 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474304914 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474325895 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474519968 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474564075 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474601030 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474623919 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474643946 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474720955 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474750996 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474786043 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474807024 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474828959 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474901915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474927902 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474961042 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.474977970 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.474992990 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475061893 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475087881 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475121021 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475136042 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475148916 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475235939 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475260973 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475296974 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475312948 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475327015 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475399017 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475424051 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475471973 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475497007 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475579977 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.475598097 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.475672960 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.680533886 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.779884100 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.779925108 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.779953003 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.780042887 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.780062914 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.780091047 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.780116081 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.780217886 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.780231953 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.780237913 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.790517092 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.790560961 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790591955 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790632963 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790713072 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.790733099 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790750980 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790769100 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790833950 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790854931 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790883064 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.790904999 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790949106 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.790983915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791009903 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791013002 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791054964 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791081905 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791136026 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791163921 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791187048 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791213036 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791239023 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791275024 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791297913 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791309118 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791325092 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791374922 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791377068 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791414022 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791492939 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791522980 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791610956 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791629076 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791645050 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791682959 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791732073 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791753054 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791827917 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791857004 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.791879892 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.791918039 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792033911 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792051077 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792248964 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792268038 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792387962 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792467117 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792541981 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792567015 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792623997 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792655945 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792783976 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792916059 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.792968988 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.792994022 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.793035984 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.793097973 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.793183088 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.793251038 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.793309927 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.793332100 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.793395996 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.793443918 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:43.793519020 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:43.793646097 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.000540018 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.000632048 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.261451006 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.261501074 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.261533022 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.261610031 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.261627913 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.261658907 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.261694908 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.269917011 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.269963980 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.269999981 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270021915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270101070 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270119905 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270168066 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270180941 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270209074 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270226002 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270235062 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270252943 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270262003 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270303011 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270314932 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270333052 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270354986 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270365953 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270399094 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270407915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270426989 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270477057 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270488977 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270509958 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270519018 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270551920 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270560980 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270572901 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270656109 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270674944 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270700932 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270711899 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270746946 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270756006 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.270796061 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270872116 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270905972 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.270961046 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271044016 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271056890 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271080971 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271121025 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271181107 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271251917 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271296978 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271311045 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271336079 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271352053 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271404028 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271424055 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271447897 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271471977 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271506071 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271553040 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271574974 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271608114 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271627903 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271693945 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271776915 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271819115 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271832943 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271861076 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.271918058 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.271981955 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.476538897 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.505197048 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.505229950 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.505378008 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.514698029 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.514718056 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514818907 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514837980 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514868975 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.514882088 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514914036 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.514924049 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514945030 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.514985085 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.514997005 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.515067101 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.515079975 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.515100002 CEST44349742185.199.108.133192.168.2.4
                                                                                        Jul 25, 2022 15:17:44.515113115 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.515151024 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.800728083 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.823117971 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.979460001 CEST49742443192.168.2.4185.199.108.133
                                                                                        Jul 25, 2022 15:17:44.979558945 CEST44349742185.199.108.133192.168.2.4

                                                                                        UDP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Jul 25, 2022 15:17:41.342784882 CEST5034253192.168.2.48.8.8.8
                                                                                        Jul 25, 2022 15:17:41.363118887 CEST53503428.8.8.8192.168.2.4
                                                                                        Jul 25, 2022 15:17:42.019869089 CEST5671953192.168.2.48.8.8.8
                                                                                        Jul 25, 2022 15:17:42.039489985 CEST53567198.8.8.8192.168.2.4

                                                                                        DNS Queries

                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                        Jul 25, 2022 15:17:41.342784882 CEST192.168.2.48.8.8.80xc8ddStandard query (0)github.comA (IP address)IN (0x0001)
                                                                                        Jul 25, 2022 15:17:42.019869089 CEST192.168.2.48.8.8.80x83Standard query (0)raw.githubusercontent.comA (IP address)IN (0x0001)

                                                                                        DNS Answers

                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                        Jul 25, 2022 15:17:41.363118887 CEST8.8.8.8192.168.2.40xc8ddNo error (0)github.com140.82.121.3A (IP address)IN (0x0001)
                                                                                        Jul 25, 2022 15:17:42.039489985 CEST8.8.8.8192.168.2.40x83No error (0)raw.githubusercontent.com185.199.108.133A (IP address)IN (0x0001)
                                                                                        Jul 25, 2022 15:17:42.039489985 CEST8.8.8.8192.168.2.40x83No error (0)raw.githubusercontent.com185.199.109.133A (IP address)IN (0x0001)
                                                                                        Jul 25, 2022 15:17:42.039489985 CEST8.8.8.8192.168.2.40x83No error (0)raw.githubusercontent.com185.199.110.133A (IP address)IN (0x0001)
                                                                                        Jul 25, 2022 15:17:42.039489985 CEST8.8.8.8192.168.2.40x83No error (0)raw.githubusercontent.com185.199.111.133A (IP address)IN (0x0001)

                                                                                        HTTP Request Dependency Graph

                                                                                        • github.com
                                                                                        • raw.githubusercontent.com

                                                                                        HTTPS Proxied Packets

                                                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                        0192.168.2.449738140.82.121.3443C:\Windows\SysWOW64\wget.exe
                                                                                        TimestampkBytes transferredDirectionData
                                                                                        2022-07-25 13:17:41 UTC0OUTGET /MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
                                                                                        Accept: */*
                                                                                        Accept-Encoding: identity
                                                                                        Host: github.com
                                                                                        Connection: Keep-Alive
                                                                                        2022-07-25 13:17:41 UTC0INHTTP/1.1 302 Found
                                                                                        Server: GitHub.com
                                                                                        Date: Mon, 25 Jul 2022 13:17:41 GMT
                                                                                        Content-Type: text/html; charset=utf-8
                                                                                        Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
                                                                                        permissions-policy: interest-cohort=()
                                                                                        Access-Control-Allow-Origin: https://render.githubusercontent.com
                                                                                        Location: https://raw.githubusercontent.com/MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe
                                                                                        Cache-Control: no-cache
                                                                                        Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
                                                                                        X-Frame-Options: deny
                                                                                        X-Content-Type-Options: nosniff
                                                                                        X-XSS-Protection: 0
                                                                                        Referrer-Policy: no-referrer-when-downgrade
                                                                                        Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
                                                                                        2022-07-25 13:17:41 UTC0INData Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 62 6c 6f 63 6b 2d 61 6c 6c 2d 6d 69 78 65 64 2d 63 6f 6e 74 65 6e 74 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 6f 62 6a 65 63 74 73 2d 6f 72 69 67 69 6e 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e
                                                                                        Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.


                                                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                        1192.168.2.449742185.199.108.133443C:\Windows\SysWOW64\wget.exe
                                                                                        TimestampkBytes transferredDirectionData
                                                                                        2022-07-25 13:17:42 UTC2OUTGET /MindShow/USBDisplay/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
                                                                                        Accept: */*
                                                                                        Accept-Encoding: identity
                                                                                        Host: raw.githubusercontent.com
                                                                                        Connection: Keep-Alive
                                                                                        2022-07-25 13:17:42 UTC2INHTTP/1.1 200 OK
                                                                                        Connection: close
                                                                                        Content-Length: 3411586
                                                                                        Cache-Control: max-age=300
                                                                                        Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
                                                                                        Content-Type: application/octet-stream
                                                                                        ETag: "e34873714e8820a02103a8b2c51766fda43edbae58b8e1176cc5350a295d94f1"
                                                                                        Strict-Transport-Security: max-age=31536000
                                                                                        X-Content-Type-Options: nosniff
                                                                                        X-Frame-Options: deny
                                                                                        X-XSS-Protection: 1; mode=block
                                                                                        X-GitHub-Request-Id: F1F2:CDC1:750E09:7E1770:62DE97F6
                                                                                        Accept-Ranges: bytes
                                                                                        Date: Mon, 25 Jul 2022 13:17:42 GMT
                                                                                        Via: 1.1 varnish
                                                                                        X-Served-By: cache-mxp6927-MXP
                                                                                        X-Cache: MISS
                                                                                        X-Cache-Hits: 0
                                                                                        X-Timer: S1658755062.161637,VS0,VE352
                                                                                        Vary: Authorization,Accept-Encoding,Origin
                                                                                        Access-Control-Allow-Origin: *
                                                                                        X-Fastly-Request-ID: 5b9a35302f87d447e07e7968166011ef95e6e5b1
                                                                                        Expires: Mon, 25 Jul 2022 13:22:42 GMT
                                                                                        Source-Age: 0
                                                                                        2022-07-25 13:17:42 UTC3INData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                        Data Ascii: MZP@!L!This program must be run under Win32$7
                                                                                        2022-07-25 13:17:42 UTC5INData Raw: 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 5c 12 40 00 03 08 57 6f 72
                                                                                        Data Ascii: tt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem\@Wor
                                                                                        2022-07-25 13:17:42 UTC6INData Raw: 02 00 12 84 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 18 7c 4b 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 84 15 40 00 04 4c 65 66 74 02 00 12 84 15 40 00 05 52 69 67 68 74 02 00 02 00 68 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 1f 40 00 00 00 00 00 68 17 40 00 00 00 00 00 7e 18 40 00 08 00 00 00 00 00 00 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 00 00 22 00 86 18 40 00 44 00 f4 ff ac 18 40 00 42 00 f4 ff d0 18 40 00 42 00 f4 ff f9 18 40 00 43 00 f4 ff 37 19 40 00 42 00 f4 ff 66 19 40 00 42 00 f4 ff 8f 19 40 00 43 00 f4 ff c3 19 40 00 43 00 f4 ff fc 19 40 00 43 00 f4 ff 27 1a 40 00 43 00 f4 ff 50 1a 40 00 43 00 f4
                                                                                        Data Ascii: @Right|K&op_LessThanOrEqual@@Left@Righth@@h@~@]@]@`@`@,`@0`@4`@(`@\@\@\@"@D@B@B@C7@Bf@B@C@C@C'@CP@C
                                                                                        2022-07-25 13:17:42 UTC7INData Raw: 00 bc 5d 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 5e 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 8c 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 18 7c 4b 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 18 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 5e 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 40 b8 12 40 00 01 00 01 01 02 00 02 00 34 00 18 7c 4b 00 09 55 6e 69 74 53 63 6f 70 65 03 00 b8 12 40 00 08 00
                                                                                        Data Ascii: ]@GetInterface@@Self@@IID Obj>h^@GetInterfaceEntry@Self@@IID1|KGetInterfaceTable@Self3^@UnitName@Self@@4|KUnitScope@
                                                                                        2022-07-25 13:17:42 UTC9INData Raw: e0 21 40 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 21 40 00 00 00 00 00 e0 21 40 00 00 00 00 00 e6 21 40 00 08 00 00 00 b0 1f 40 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 fc 21 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 e0 21 40 00 20 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 80 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 24 23 40 00 00 00 00 00 80 22 40 00 00 00 00 00 96 22 40 00 08 00 00 00 b0 1f 40 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 00 00 02 00 a6 22 40
                                                                                        Data Ascii: !@!@!@!@@]@]@`@`@,`@0`@4`@(`@\@\@\@VolatileAttribute!@VolatileAttribute!@ @System"@$#@"@"@@]@]@`@`@,`@0`@4`@(`@\@\@\@"@
                                                                                        2022-07-25 13:17:42 UTC10INData Raw: 49 45 6e 75 6d 65 72 61 62 6c 65 b0 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 1c 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 b0 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 b9 9e 00 00 83 44 24 04 f8 e9 d7 9e 00 00 83 44 24 04 f8 e9 e9 9e 00 00 cc 4d 27 40 00 57 27 40 00 61 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 6c 27 40 00 08 00 00 00 00 00 00 00 b0 26 40 00 f4 27 40 00 78 27 40 00 00 00 00 00 00 00 00 00 dc 28 40 00 f4 27 40 00 1b 28 40 00 00 00 00 00 39 28 40 00 10 00 00 00 10 17 40 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 e0 c5 40 00 ec c5 40 00 34 60 40 00 28 60 40 00 00
                                                                                        Data Ascii: IEnumerable&@System'@IDispatch&@FSystemD$D$D$M'@W'@a'@Fl'@&@'@x'@(@'@(@9(@@]@]@`@`@@@4`@(`@
                                                                                        2022-07-25 13:17:42 UTC11INData Raw: 40 00 08 00 00 00 02 09 56 43 75 72 72 65 6e 63 79 02 00 f8 29 40 00 08 00 00 00 02 05 56 44 61 74 65 02 00 10 12 40 00 08 00 00 00 02 07 56 4f 6c 65 53 74 72 02 00 00 11 40 00 08 00 00 00 02 09 56 44 69 73 70 61 74 63 68 02 00 28 13 40 00 08 00 00 00 02 06 56 45 72 72 6f 72 02 00 58 12 40 00 08 00 00 00 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00
                                                                                        Data Ascii: @VCurrency)@VDate@VOleStr@VDispatch(@VErrorX@VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@
                                                                                        2022-07-25 13:17:42 UTC13INData Raw: 61 79 3c 53 79 73 74 65 6d 2e 42 79 74 65 3e 01 00 00 00 00 00 00 00 11 00 00 00 b4 10 40 00 06 53 79 73 74 65 6d b4 10 40 00 02 00 00 00 e0 31 40 00 11 13 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 43 68 61 72 3e 02 00 00 00 00 00 00 00 ff ff ff ff 4c 10 40 00 06 53 79 73 74 65 6d 4c 10 40 00 02 00 00 00 18 32 40 00 11 16 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 49 6e 74 65 67 65 72 3e 04 00 00 00 00 00 00 00 03 00 00 00 9c 10 40 00 06 53 79 73 74 65 6d 9c 10 40 00 02 00 00 00 00 54 32 40 00 14 0a 50 4c 69 62 4d 6f 64 75 6c 65 68 32 40 00 02 00 00 00 6c 32 40 00 0e 0a 54 4c 69 62 4d 6f 64 75 6c 65 1c 00 00 00 00 00 00 00 00 07 00 00 00 50 32 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 70 11 40 00 04 00 00 00 02 08 49 6e 73 74 61 6e 63 65 02 00 70 11 40 00
                                                                                        Data Ascii: ay<System.Byte>@System@1@TArray<System.Char>L@SystemL@2@TArray<System.Integer>@System@T2@PLibModuleh2@l2@TLibModuleP2@Nextp@Instancep@
                                                                                        2022-07-25 13:17:42 UTC14INData Raw: ff 25 e4 22 4c 00 8b c0 ff 25 04 24 4c 00 8b c0 ff 25 fc 23 4c 00 8b c0 ff 25 14 24 4c 00 8b c0 ff 25 e8 23 4c 00 8b c0 ff 25 50 24 4c 00 8b c0 ff 25 68 24 4c 00 8b c0 ff 25 44 24 4c 00 8b c0 ff 25 b8 24 4c 00 8b c0 ff 25 44 23 4c 00 8b c0 68 20 30 4c 00 e8 96 94 00 00 59 5a 87 04 24 c3 50 52 51 68 94 30 4c 00 e9 e3 ff ff ff 8d 40 00 ff 25 94 30 4c 00 90 90 ff 25 18 25 4c 00 8b c0 ff 25 20 25 4c 00 8b c0 ff 25 0c 25 4c 00 8b c0 ff 25 50 23 4c 00 8b c0 ff 25 b8 23 4c 00 8b c0 ff 25 94 23 4c 00 8b c0 ff 25 f0 23 4c 00 8b c0 ff 25 78 23 4c 00 8b c0 ff 25 d0 24 4c 00 8b c0 ff 25 f0 24 4c 00 8b c0 ff 25 ec 24 4c 00 8b c0 ff 25 ec 23 4c 00 8b c0 68 00 30 4c 00 e8 0e 94 00 00 59 5a 87 04 24 c3 50 52 51 68 90 30 4c 00 e9 e3 ff ff ff 8d 40 00 ff 25 90 30 4c 00 90
                                                                                        Data Ascii: %"L%$L%#L%$L%#L%P$L%h$L%D$L%$L%D#Lh 0LYZ$PRQh0L@%0L%%L% %L%%L%P#L%#L%#L%#L%x#L%$L%$L%$L%#Lh0LYZ$PRQh0L@%0L
                                                                                        2022-07-25 13:17:42 UTC15INData Raw: 84 c0 74 1a 6a 0a e8 cf fb ff ff ba 01 00 00 00 33 c0 f0 0f b0 15 78 db 4b 00 84 c0 75 c3 c3 8d 40 00 53 56 57 55 8b e8 8d b5 10 00 01 00 4e 83 c6 04 81 e6 00 00 ff ff 6a 04 68 00 10 10 00 56 6a 00 e8 83 fb ff ff 8b d8 85 db 74 30 8b fb 89 6f 08 83 ce 04 89 77 0c e8 79 ff ff ff a1 80 db 4b 00 c7 07 7c db 4b 00 89 1d 80 db 4b 00 89 47 04 89 18 c6 05 78 db 4b 00 00 83 c3 10 8b c3 5d 5f 5e 5b c3 8b c0 53 56 57 55 83 c4 dc 8b f0 83 ee 10 e8 3f ff ff ff 8b c6 8b 10 89 14 24 8b 50 04 89 54 24 04 8b 50 0c f6 c2 08 75 1a 68 00 80 00 00 6a 00 56 e8 18 fb ff ff 85 c0 74 04 33 ff eb 3f 83 cf ff eb 3a 8b de 8b ea 83 e5 f0 33 ff 6a 1c 8d 44 24 0c 50 53 e8 71 fa ff ff 68 00 80 00 00 6a 00 53 e8 e8 fa ff ff 85 c0 75 05 83 cf ff eb 0e 8b 74 24 14 3b ee 76 06 2b ee 01 f3
                                                                                        Data Ascii: tj3xKu@SVWUNjhVjt0owyK|KKGxK]_^[SVWU?$PT$PuhjVt3?:3jD$PSqhjSut$;v+
                                                                                        2022-07-25 13:17:42 UTC17INData Raw: 83 cb 02 89 58 fc eb 07 89 d8 e8 e9 f9 ff ff c6 05 e8 ba 4b 00 00 5b c3 56 57 8d 3c cd 78 bb 4b 00 8b 77 04 8b 46 04 89 47 04 89 38 39 c7 75 17 b8 fe ff ff ff d3 c0 21 04 95 f8 ba 4b 00 75 07 0f b3 15 f4 ba 4b 00 bf f0 ff ff ff 23 7e fc 89 fa 29 da 74 1f 8d 04 33 8d 4a 03 89 48 fc 89 54 02 f8 81 fa 30 0b 00 00 72 0f e8 bd f8 ff ff eb 08 90 90 90 80 64 37 fc f7 8d 4b 02 89 4e fc c6 05 e8 ba 4b 00 00 89 f0 5f 5e 5b c3 5b 85 c0 0f 89 2b fa ff ff 31 c0 c3 8b 50 fc f6 c2 07 89 c1 53 8a 1d 59 b0 4b 00 0f 85 e3 00 00 00 84 db 8b 1a 75 61 83 6a 14 01 8b 42 10 74 2c 85 c0 89 4a 10 8d 40 01 89 41 fc 74 07 31 c0 88 03 5b c3 90 8b 4b 08 89 5a 0c 89 4a 08 89 51 0c 89 53 08 c6 03 00 31 c0 5b c3 90 90 85 c0 74 13 8b 42 0c 8b 4a 08 89 48 08 89 41 0c 31 c0 39 53 18 75 03
                                                                                        Data Ascii: XK[VW<xKwFG89u!KuK#~)t3JHT0rd7KNK_^[[+1PSYKuajBt,J@At1[KZJQS1[tBJHA19Su
                                                                                        2022-07-25 13:17:42 UTC18INData Raw: 89 c5 89 cf 52 e8 a8 f7 ff ff 5a 85 c0 74 d1 81 fd 2c 0a 04 00 76 03 89 50 f8 89 c5 89 c2 89 f0 89 f9 e8 17 f3 ff ff 89 f0 e8 08 fb ff ff 89 e8 5d 5f 5e 5b c3 90 5e 5b f6 c1 03 0f 84 25 f6 ff ff 31 c0 c3 8b c0 53 8d 58 ff 83 e3 fc e8 60 f7 ff ff 83 f8 01 19 c9 8d 14 03 09 cb 81 fb 2c 0a 04 00 73 12 f7 db d9 ee dd 14 13 83 c3 08 78 f8 89 0a dd c0 d9 f7 5b c3 8b c0 53 56 51 8b f2 8b d8 80 3d 58 b0 4b 00 00 74 61 6a 00 8d 44 24 04 50 8b c6 e8 22 37 00 00 50 56 6a f4 e8 71 ee ff ff 50 e8 77 f0 ff ff 6a 00 8d 44 24 04 50 a1 78 70 4b 00 e8 02 37 00 00 50 a1 78 70 4b 00 50 6a f4 e8 4c ee ff ff 50 e8 52 f0 ff ff 6a 00 8d 44 24 04 50 8b c3 e8 e0 36 00 00 50 53 6a f4 e8 2f ee ff ff 50 e8 35 f0 ff ff eb 0e 68 10 20 00 00 56 53 6a 00 e8 51 ef ff ff 5a 5e 5b c3 90 8b
                                                                                        Data Ascii: RZt,vP]_^[^[%1SX`,sx[SVQ=XKtajD$P"7PVjqPwjD$PxpK7PxpKPjLPRjD$P6PSj/P5h VSjQZ^[
                                                                                        2022-07-25 13:17:42 UTC18INData Raw: 10 3b 5a 14 76 19 8b f0 8b de 83 eb 04 8b 1b 83 e3 f0 03 de 0f b7 42 02 2b d8 89 19 5e 5b c3 8b 42 10 48 89 01 5e 5b c3 8b c0 53 56 57 55 83 c4 ec 8b ea 8b d8 33 f6 8b fb b9 0a 00 00 00 8b c3 33 d2 f7 f1 89 c3 8b c3 03 c0 8d 04 80 2b f8 46 8b d7 80 c2 30 b8 14 00 00 00 2b c6 88 14 04 85 db 75 d4 8b d5 8d 04 04 8b ce e8 9b 0c 00 00 8d 04 2e 83 c4 14 5d 5f 5e 5b c3 53 56 8b f1 8b da 8b d3 8b ce e8 81 0c 00 00 8b c3 03 c6 5e 5b c3 8b c0 53 8b da 85 c0 74 12 83 c0 c8 8b 00 0f b6 08 40 8b d3 e8 d1 ff ff ff 5b c3 a1 6c 70 4b 00 e8 91 35 00 00 8b c8 8b d3 a1 6c 70 4b 00 e8 b7 ff ff ff 5b c3 90 55 8b ec 53 8b d0 81 fa ff ff 00 00 76 65 f6 c2 03 75 60 8b 55 08 8b 52 e4 8b c8 3b d1 77 0d 8b 5d 08 03 53 f0 83 c1 04 3b d1 73 17 8b 55 08 33 c9 89 4a f0 6a 1c 8b 55 08
                                                                                        Data Ascii: ;ZvB+^[BH^[SVWU33+F0+u.]_^[SV^[St@[lpK5lpK[USveu`UR;w]S;sU3JjU
                                                                                        2022-07-25 13:17:42 UTC20INData Raw: fe ff 8b c3 e8 2f fd ff ff 84 c0 75 20 c6 85 ff 47 fe ff 00 8b 85 f8 47 fe ff 8b 95 ec 47 fe ff 89 94 85 dc 07 fe ff ff 85 f8 47 fe ff 8b c3 e8 f4 f9 ff ff 8b d8 85 db 75 8e 8b 7f 04 81 ff d8 ba 4b 00 0f 85 72 ff ff ff 8b 1d 80 db 4b 00 eb 37 8b c3 83 c0 10 e8 dd fc ff ff 84 c0 75 26 c6 85 ff 47 fe ff 00 8b 73 0c 83 e6 f0 83 ee 04 83 ee 10 8b 85 f8 47 fe ff 89 b4 85 dc 07 fe ff ff 85 f8 47 fe ff 8b 5b 04 81 fb 7c db 4b 00 74 0c 81 bd f8 47 fe ff 00 10 00 00 7c b5 80 bd ff 47 fe ff 00 0f 85 a6 02 00 00 c6 85 f7 47 fe ff 00 33 c0 89 85 e8 47 fe ff a1 5c 70 4b 00 e8 22 30 00 00 8b c8 8d 95 dc 87 fd ff a1 5c 70 4b 00 e8 44 fa ff ff 8b d8 c7 85 f0 47 fe ff 37 00 00 00 c7 85 e0 47 fe ff 82 70 4b 00 8d 85 fc 4f fe ff 89 85 dc 47 fe ff 8b 85 e0 47 fe ff 0f b7 00
                                                                                        Data Ascii: /u GGGGuKrK7u&GsGG[|KtG|GG3G\pK"0\pKDG7GpKOGG
                                                                                        2022-07-25 13:17:42 UTC21INData Raw: e8 d1 e4 ff ff 8b f7 3b f3 75 ea 89 1b 89 5b 04 5d 5f 5e 5b c3 90 83 3d 94 db 4b 00 00 74 12 a1 94 db 4b 00 50 e8 a8 e2 ff ff 33 c0 a3 94 db 4b 00 80 3d 88 b9 4b 00 00 74 05 e8 ab f9 ff ff 83 3d 8c db 4b 00 00 74 19 68 00 80 00 00 6a 00 a1 8c db 4b 00 50 e8 7c e4 ff ff 33 c0 a3 8c db 4b 00 e8 00 ff ff ff c3 8d 40 00 85 c0 74 0a ff 15 6c 77 4b 00 85 c0 74 02 f3 c3 b0 01 e9 5d 01 00 00 c3 85 c0 7e 13 ff 15 60 77 4b 00 85 c0 74 02 f3 c3 b0 01 e9 45 01 00 00 31 c0 f3 c3 90 85 c0 74 0a ff 15 64 77 4b 00 85 c0 75 02 f3 c3 b0 02 e9 29 01 00 00 c3 8b 08 85 c9 74 32 85 d2 74 18 50 89 c8 ff 15 68 77 4b 00 59 09 c0 74 19 89 01 c3 b0 02 e9 06 01 00 00 89 10 89 c8 ff 15 64 77 4b 00 09 c0 75 eb c3 b0 01 e9 f0 00 00 00 85 d2 74 10 50 89 d0 ff 15 60 77 4b 00 59 09 c0 74
                                                                                        Data Ascii: ;u[]_^[=KtKP3K=Kt=KthjKP|3K@tlwKt]~`wKtE1tdwKu)t2tPhwKYtdwKutP`wKYt
                                                                                        2022-07-25 13:17:42 UTC22INData Raw: 02 ff 83 e2 fe f7 da 8d 14 55 1e 59 40 00 ff e2 90 90 66 89 48 1c 66 89 48 1a 66 89 48 18 66 89 48 16 66 89 48 14 66 89 48 12 66 89 48 10 66 89 48 0e 66 89 48 0c 66 89 48 0a 66 89 48 08 66 89 48 06 66 89 48 04 66 89 48 02 66 89 08 c3 c3 90 53 56 57 89 c6 50 85 c0 0f 84 83 00 00 00 31 c0 31 db bf cc cc cc 0c 66 8b 1e 83 c6 02 66 83 fb 20 74 f4 b5 00 66 83 fb 2d 74 76 66 83 fb 2b 74 72 66 83 fb 24 74 74 66 83 fb 78 74 6e 66 83 fb 58 74 68 66 83 fb 30 75 19 66 8b 1e 83 c6 02 66 83 fb 78 74 56 66 83 fb 58 74 50 66 85 db 74 27 eb 05 66 85 db 74 35 66 83 eb 30 66 83 fb 09 77 2b 39 f8 77 27 8d 04 80 01 c0 01 d8 66 8b 1e 83 c6 02 66 85 db 75 e0 fe cd 74 0b 85 c0 7d 68 eb 0b 83 c6 02 eb 06 f7 d8 7e 5d 78 5b 5b 29 de eb 59 fe c5 66 8b 1e 83 c6 02 eb 86 bf ff ff ff
                                                                                        Data Ascii: UY@fHfHfHfHfHfHfHfHfHfHfHfHfHfHfSVWP11ff tf-tvf+trf$ttfxtnfXthf0uffxtVfXtPft'ft5f0fw+9w'ffut}h~]x[[)Yf
                                                                                        2022-07-25 13:17:42 UTC24INData Raw: 00 84 c0 74 02 89 3b 83 3b 00 0f 95 c0 8b d8 33 c0 5a 59 59 64 89 10 68 5e 5e 40 00 8d 45 f8 e8 26 56 00 00 c3 e9 e0 11 00 00 eb f0 8b c3 5f 5e 5b 59 59 5d c3 90 53 56 89 c3 8b 43 ac 85 c0 74 29 8b 08 83 c0 04 8b 32 3b 30 75 18 8b 72 04 3b 70 04 75 10 8b 72 08 3b 70 08 75 08 8b 72 0c 3b 70 0c 74 13 83 c0 1c 49 75 dc 8b 5b d0 85 db 74 04 8b 1b eb c5 31 c0 5e 5b c3 53 56 81 c4 00 ff ff ff 8b f2 e8 49 01 00 00 85 c0 74 5e 8b d0 8b ca 83 c1 02 42 0f b6 02 03 c8 8d 59 0a 80 7b 01 40 74 0b 8b d6 8b c3 e8 ae 6a 00 00 eb 44 54 8d 44 24 04 66 ba 3a 00 b9 ff 00 00 00 e8 9d 25 00 00 8d 44 24 04 8b d3 b9 01 00 00 00 e8 05 2b 00 00 8b d0 42 8b c3 b9 ff ff ff 7f e8 a6 21 00 00 8b c4 8b d6 e8 71 6a 00 00 eb 07 8b c6 e8 fc 1a 00 00 81 c4 00 01 00 00 5e 5b c3 8d 40 00 53
                                                                                        Data Ascii: t;;3ZYYdh^^@E&V_^[YY]SVCt)2;0ur;pur;pur;ptIu[t1^[SVIt^BY{@tjDTD$f:%D$+B!qj^[@S
                                                                                        2022-07-25 13:17:42 UTC25INData Raw: 83 fa 13 75 09 6a 01 e8 ac d4 ff ff eb 2d 8b c1 b9 05 00 00 00 99 f7 f9 83 fa 04 75 09 6a 00 e8 94 d4 ff ff eb 15 e8 d9 d2 ff ff eb 0e 8b c8 b8 04 00 00 00 d3 e0 e8 45 00 00 00 ff 03 83 3b 00 7d 06 c7 03 0a 00 00 00 5e 5b c3 90 53 51 8b d8 33 c0 89 04 24 8b 13 85 d2 75 0f 8b c2 b9 01 00 00 00 f0 0f b1 0b 3b d0 74 09 8b c4 e8 63 ff ff ff eb e2 5a 5b c3 8b c0 33 d2 f0 87 10 c3 8b c0 83 f8 00 7e 08 f3 90 48 83 f8 00 7f f8 c3 8b c0 55 8b ec 83 c4 f4 33 c0 89 45 f4 68 e8 64 40 00 68 08 65 40 00 e8 b2 d2 ff ff 50 e8 b4 d2 ff ff 85 c0 0f 84 8d 00 00 00 8d 45 f4 50 6a 00 e8 b1 d3 ff ff 85 c0 75 7e e8 68 d2 ff ff 83 f8 7a 75 74 8b 45 f4 e8 83 ef ff ff 89 45 f8 33 d2 55 68 d2 64 40 00 64 ff 32 64 89 22 8d 45 f4 50 8b 45 f8 50 e8 7d d3 ff ff 8b 45 f8 83 7d f4 00 76
                                                                                        Data Ascii: uj-ujE;}^[SQ3$u;tcZ[3~HU3Ehd@he@PEPju~hzutEE3Uhd@d2d"EPEP}E}v
                                                                                        2022-07-25 13:17:42 UTC26INData Raw: ea 04 8b c2 c3 90 8b 10 83 c2 cc 8b 12 03 d0 83 ea 04 8b c2 c3 90 53 56 51 8b 10 83 c2 cc 8b 32 03 f0 83 ee 04 8b 06 89 04 24 8b 1c 24 83 e3 fe 85 db 75 30 e8 0d fc ff ff 8b d0 8b 0c 24 83 e1 01 0b ca 8b 04 24 f0 0f b1 0e 8b 06 89 04 24 8b 1c 24 83 e3 fe 85 db 74 e2 3b d3 74 07 8b c2 e8 12 d9 ff ff 8b c3 5a 5e 5b c3 53 e8 a2 fc ff ff 85 c0 74 10 8b 40 08 8b 1d f8 b8 4b 00 33 c9 33 d2 ff 53 10 5b c3 53 8b d8 83 3d f8 b8 4b 00 00 75 07 b0 1a e8 bd eb ff ff 8b c3 e8 76 ff ff ff e8 c5 ff ff ff 5b c3 8d 40 00 53 56 8b f0 8b c6 e8 5d fc ff ff 8b d8 85 db 74 1d 8b 43 08 8b 1d f8 b8 4b 00 33 c9 33 d2 ff 53 10 8b c6 e8 40 fc ff ff 8b d8 85 db 75 e3 5e 5b c3 8d 40 00 53 8b d8 83 3d f8 b8 4b 00 00 75 07 b0 1a e8 65 eb ff ff 8b c3 e8 1e ff ff ff e8 ad ff ff ff 5b c3
                                                                                        Data Ascii: SVQ2$$u0$$$$t;tZ^[St@K33S[S=Kuv[@SV]tCK33S@u^[@S=Kue[
                                                                                        2022-07-25 13:17:42 UTC28INData Raw: 00 52 ff 15 20 b0 4b 00 8b 7c 24 28 e8 f7 5d 00 00 ff b0 00 00 00 00 89 a0 00 00 00 00 8b 6f 08 8b 5f 04 c7 47 04 8c 6e 40 00 83 c3 05 e8 66 fe ff ff ff e3 e9 53 02 00 00 e8 ca 5d 00 00 8b 88 00 00 00 00 8b 11 89 90 00 00 00 00 8b 41 08 e9 3c ee ff ff b8 01 00 00 00 c3 8b c0 8b 44 24 04 f7 40 04 06 00 00 00 0f 85 6f 01 00 00 81 38 de fa ed 0e 74 1f fc e8 f9 ec ff ff 8b 15 14 b0 4b 00 85 d2 0f 84 53 01 00 00 ff d2 85 c0 75 0a e9 48 01 00 00 8b 40 18 8b 00 8b 54 24 08 53 56 57 55 8b 4a 04 8b 59 05 8d 71 09 89 c5 8b 06 85 c0 74 43 89 ef eb 02 8b 3f 8b 00 39 f8 74 37 8b 48 cc 3b 4f cc 75 17 8b 40 c8 8b 57 c8 31 c9 8a 08 3a 0a 75 09 40 42 e8 09 11 00 00 74 18 8b 7f d0 8b 06 85 ff 75 d0 83 c6 08 4b 75 c0 5d 5f 5e 5b e9 e7 00 00 00 8b 44 24 14 81 38 de fa ed 0e
                                                                                        Data Ascii: R K|$(]o_Gn@fS]A<D$@o8tKSuH@T$SVWUJYqtC?9t7H;Ou@W1:u@BtuKu]_^[D$8
                                                                                        2022-07-25 13:17:42 UTC29INData Raw: 00 85 c0 74 53 8b 1d a4 db 4b 00 8b 78 04 33 c0 55 68 fe 73 40 00 64 ff 30 64 89 20 85 db 7e 1a 4b 89 1d a4 db 4b 00 8b 74 df 04 85 f6 74 07 83 3e 00 74 02 ff d6 85 db 7f e6 33 c0 5a 59 59 64 89 10 eb 14 e9 85 f9 ff ff e8 a8 ff ff ff e8 7f fd ff ff e8 ce fd ff ff 5f 5e 5b 5d c3 90 55 8b ec 51 53 56 57 a1 a0 db 4b 00 85 c0 74 56 8b 38 33 db 8b 40 04 89 45 fc 33 c0 55 68 6a 74 40 00 64 ff 30 64 89 20 3b fb 7e 1c 8b 45 fc 8b 34 d8 43 89 1d a4 db 4b 00 85 f6 74 07 83 3e 00 74 02 ff d6 3b fb 7f e4 33 c0 5a 59 59 64 89 10 eb 14 e9 19 f9 ff ff e8 3c ff ff ff e8 13 fd ff ff e8 62 fd ff ff 5f 5e 5b 59 5d c3 c7 05 1c b0 4b 00 b0 36 40 00 c7 05 20 b0 4b 00 b8 36 40 00 a3 a0 db 4b 00 33 c0 a3 a4 db 4b 00 89 15 a8 db 4b 00 8b 42 04 a3 40 b0 4b 00 b8 98 db 4b 00 e8 ac
                                                                                        Data Ascii: tSKx3Uhs@d0d ~KKtt>t3ZYYd_^[]UQSVWKtV83@E3Uhjt@d0d ;~E4CKt>t;3ZYYd<b_^[Y]K6@ K6@K3KKB@KK
                                                                                        2022-07-25 13:17:42 UTC30INData Raw: c6 05 59 b0 4b 00 01 8b 45 08 50 8b 45 0c 50 53 b8 a8 78 40 00 50 8b 45 f8 50 8b 45 fc 50 e8 49 bd ff ff 8b f0 85 f6 75 07 8b c3 e8 c0 da ff ff 8b c6 5f 5e 5b 59 59 5d c2 0c 00 90 53 8b d8 83 3d 38 70 4b 00 00 74 08 8b c3 ff 15 38 70 4b 00 53 e8 2e bd ff ff 5b c3 85 c0 7e 39 50 01 c0 70 2f 83 c0 0e 70 2a e8 69 da ff ff 83 c0 0c 5a c7 40 f8 01 00 00 00 89 50 fc 66 c7 04 50 00 00 66 c7 40 f6 02 00 8b 15 80 b9 4b 00 66 89 50 f4 c3 e9 2f e2 ff ff 31 c0 c3 85 c0 7e 43 50 83 c0 0e 70 38 83 e0 fe 52 50 e8 28 da ff ff 5a 59 66 c7 44 02 fe 00 00 83 c0 0c 5a 89 50 fc c7 40 f8 01 00 00 00 85 c9 75 06 8b 0d 7c b9 4b 00 89 ca 66 89 50 f4 66 c7 40 f6 01 00 c3 e9 e5 e1 ff ff 31 c0 c3 8b c0 b0 01 e9 45 db ff ff c3 85 c0 74 10 50 6a 00 e8 b4 bd ff ff 85 c0 0f 84 e4 ff ff
                                                                                        Data Ascii: YKEPEPSx@PEPEPIu_^[YY]S=8pKt8pKS.[~9Pp/p*iZ@PfPf@KfP/1~CPp8RP(ZYfDZP@u|KfPf@1EtPj
                                                                                        2022-07-25 13:17:42 UTC32INData Raw: ff ff 8b 4a fc d1 e9 0f 84 dd fb ff ff 51 52 50 e8 3d b9 ff ff 85 c0 0f 84 65 fb ff ff c3 85 d2 74 28 8b 4a f8 41 7f 1e 50 52 8b 42 fc 0f b7 52 f4 e8 00 fb ff ff 89 c2 58 52 8b 48 fc e8 f4 d6 ff ff 5a 58 eb 04 f0 ff 42 f8 87 10 85 d2 74 14 8b 4a f8 49 7c 0e f0 ff 4a f8 75 08 8d 42 f4 e8 2a d5 ff ff c3 90 85 c0 74 05 83 e8 04 8b 00 c3 8b c0 33 d2 85 c0 74 09 eb 01 42 80 3c 10 00 75 f9 8b c2 c3 8b c0 33 d2 85 c0 74 0a eb 01 42 66 83 3c 50 00 75 f8 8b c2 c3 90 8b 10 85 d2 74 38 8b 4a f8 49 74 32 53 89 c3 8b 42 fc e8 45 fa ff ff 89 c2 87 03 50 8b 48 fc d1 e1 e8 76 d6 ff ff 58 8b 48 f8 49 7c 0e f0 ff 48 f8 75 08 8d 40 f4 e8 b9 d4 ff ff 8b 13 5b 89 d0 c3 8d 40 00 8b 10 85 d2 74 3a 8b 4a f8 49 74 34 53 89 c3 8b 42 fc 0f b7 52 f4 e8 3d fa ff ff 89 c2 87 03 50 8b
                                                                                        Data Ascii: JQRP=et(JAPRBRXRHZXBtJI|JuB*t3tB<u3tBf<Put8JIt2SBEPHvXHI|Hu@[@t:JIt4SBR=P
                                                                                        2022-07-25 13:17:42 UTC33INData Raw: 26 8b 0e 8b 1f 39 d9 75 41 4a 74 15 8b 4e 04 8b 5f 04 39 d9 75 34 83 c6 08 83 c7 08 4a 75 e2 eb 06 83 c6 04 83 c7 04 5a 83 e2 02 74 0b 66 8b 0e 66 8b 1f 66 39 d9 75 21 01 c0 eb 1d 8b 57 fc 29 d0 eb 16 8b 46 fc 29 d0 eb 0f 5a 66 39 d9 75 09 c1 e9 10 c1 eb 10 66 39 d9 5f 5e 5b c3 8d 40 00 e9 77 ff ff ff c3 8b c0 53 56 57 8b f2 8b f8 33 db 85 f6 7e 2d 8b c6 e8 ac f5 ff ff 8b d8 8b 07 85 c0 74 07 83 e8 04 8b 00 d1 e8 85 c0 7e 13 3b f0 7d 02 8b c6 8b c8 03 c9 8b d3 8b 07 e8 32 d1 ff ff 8b c7 8b d3 e8 59 fe ff ff 5f 5e 5b c3 90 53 56 81 c4 fc fe ff ff 8b d9 66 89 14 24 8b f0 81 fb ff 00 00 00 7e 05 bb ff 00 00 00 6a 01 8d 4c 24 04 8d 44 24 06 ba ff 00 00 00 e8 af f6 ff ff 85 c0 7d 04 33 c0 eb 06 3b d8 7d 02 8b c3 88 06 85 c0 7e 0d 8d 56 01 8d 4c 24 02 91 e8 d2
                                                                                        Data Ascii: &9uAJtN_9u4JuZtfff9u!W)F)Zf9uf9_^[@wSVW3~-t~;}2Y_^[SVf$~jL$D$}3;}~VL$
                                                                                        2022-07-25 13:17:42 UTC34INData Raw: 40 00 55 8b ec 53 56 8b d8 85 db 74 05 83 eb 04 8b 1b 83 fa 01 7d 04 33 d2 eb 07 4a 3b da 7d 02 8b d3 85 c9 7d 04 33 f6 eb 0a 8b f3 2b f2 3b ce 7d 02 8b f1 8b 4d 08 03 d2 03 d0 8b c6 91 e8 bb f2 ff ff 5e 5b 5d c2 04 00 90 53 56 57 8b f9 8b da 8b f0 8b c6 e8 14 f6 ff ff 8b 06 85 c0 74 05 83 e8 04 8b 00 83 fb 01 7c 36 3b c3 7c 32 85 ff 7e 2e 4b 8b d0 2b d3 2b d7 8b fa 85 ff 7d 02 33 ff 2b c7 8b 16 8d 04 42 8b cf 03 c9 8b 16 8d 14 5a e8 74 cc ff ff 8d 14 1f 8b c6 e8 1a fd ff ff 5f 5e 5b c3 8b c0 53 56 57 55 83 c4 f4 8b f1 8b fa 89 04 24 8b 04 24 85 c0 74 05 83 e8 04 8b 00 8b e8 85 ed 0f 8e 8b 00 00 00 8b 07 85 c0 74 05 83 e8 04 8b 00 8b d8 83 fe 01 7d 04 33 f6 eb 07 4e 3b de 7d 02 8b f3 8b 07 3b 04 24 0f 94 44 24 08 8d 44 1d 00 89 44 24 04 83 7c 24 04 00 7d
                                                                                        Data Ascii: @USVt}3J;}}3+;}M^[]SVWt|6;|2~.K++}3+BZt_^[SVWU$$tt}3N;};$D$DD$|$}
                                                                                        2022-07-25 13:17:42 UTC36INData Raw: 02 e9 3a c7 ff ff 5f 5e 5b 58 c3 90 b9 01 00 00 00 e9 e6 fe ff ff c3 90 31 c9 53 8a 4a 01 56 57 89 c3 8d 74 11 0a 8b 7c 11 06 85 ff 74 1d 8b 16 85 d2 74 17 8b 46 04 01 d8 8b 12 b9 01 00 00 00 e8 23 00 00 00 83 c6 08 4f 7f e3 5f 5e 5b c3 90 83 3d 14 70 4b 00 00 74 07 ff 15 14 70 4b 00 c3 b0 10 e8 d9 c6 ff ff c3 53 56 57 85 c9 0f 84 b4 00 00 00 89 c3 89 d6 89 cf 31 d2 8a 06 8a 56 01 3c 0a 74 26 3c 0b 74 31 3c 12 74 1e 3c 0c 74 38 3c 0d 74 43 3c 0e 74 5d 3c 0f 74 6f 3c 11 74 7a b0 02 5f 5e 5b e9 96 c6 ff ff 8b 03 83 c3 04 e8 54 ec ff ff 4f 7f f3 eb 6e 89 d8 83 c3 04 e8 55 ec ff ff 4f 7f f3 eb 5f 89 d8 83 c3 10 e8 7e ff ff ff 4f 7f f3 eb 50 55 89 d5 8b 54 2e 0a 89 d8 03 5c 2e 02 8b 4c 2e 06 8b 12 e8 79 ff ff ff 4f 7f e8 5d eb 32 55 89 d5 89 d8 03 5c 2e 02 89
                                                                                        Data Ascii: :_^[X1SJVWt|ttF#O_^[=pKtpKSVW1V<t&<t1<t<t8<tC<t]<to<tz_^[TOnUO_~OPUT.\.L.yO]2U\.
                                                                                        2022-07-25 13:17:42 UTC37INData Raw: 84 aa 00 00 00 80 f9 11 0f 84 b5 00 00 00 b0 02 5d 5f 5e 5b e9 c5 c1 ff ff 89 d8 8b 16 e8 0c eb ff ff 83 c3 04 83 c6 04 4d 75 ee e9 a7 00 00 00 89 d8 8b 16 e8 cd ea ff ff 83 c3 04 83 c6 04 4d 75 ee e9 90 00 00 00 89 d8 8b 16 e8 42 ea ff ff 83 c3 04 83 c6 04 4d 75 ee eb 7c 89 d8 89 f2 e8 66 fb ff ff 83 c3 10 83 c6 10 4d 75 ee eb 68 31 c9 8a 4f 01 8d 7c 39 02 89 d8 89 f2 8b 4f 08 8b 09 ff 77 04 e8 41 ff ff ff 03 1f 03 37 4d 75 e8 eb 45 89 d8 89 f2 89 f9 e8 51 fb ff ff 31 c0 8a 47 01 03 5c 38 02 03 74 38 02 4d 75 e5 eb 28 89 d8 8b 16 e8 6e 20 00 00 83 c3 04 83 c6 04 4d 75 ee eb 14 89 d8 8b 16 89 f9 e8 2c 09 00 00 83 c3 04 83 c6 04 4d 75 ec 5d 5f 5e 5b c2 04 00 c3 8d 40 00 55 8b ec 83 c4 f8 53 56 57 89 4d f8 89 55 fc 8b f8 8b 75 08 85 f6 0f 84 dd 00 00 00 8b
                                                                                        Data Ascii: ]_^[MuMuBMu|fMuh1O|9OwA7MuEQ1G\8t8Mu(n Mu,Mu]_^[@USVWMUu
                                                                                        2022-07-25 13:17:42 UTC38INData Raw: 00 74 37 8b 44 fe 0a 8b 18 80 3b 0d 75 14 0f b6 43 01 03 c3 8b 40 0a 8b 00 e8 8a ff ff ff 84 c0 75 18 80 3b 0e 75 0b 8b c3 e8 7a ff ff ff 84 c0 75 08 47 4d 75 c6 c6 04 24 00 0f b6 04 24 5a 5d 5f 5e 5b c3 53 56 8b f0 e8 43 33 00 00 3b b0 08 00 00 00 75 0e e8 36 33 00 00 0f b6 98 0c 00 00 00 eb 1f 8b c6 e8 3e ff ff ff 8b d8 e8 1f 33 00 00 89 b0 08 00 00 00 e8 14 33 00 00 88 98 0c 00 00 00 8b c3 5e 5b c3 90 55 8b ec 83 c4 dc 53 56 57 89 4d f4 89 55 f8 89 45 fc 8b 45 fc 8b 00 89 45 e0 8b 45 08 8b 18 85 db 7f 1b 85 db 7d 07 b0 04 e8 c6 bb ff ff 8b 45 fc 8b 55 f8 e8 93 03 00 00 e9 60 02 00 00 33 c0 89 45 ec 83 7d e0 00 74 0d 83 6d e0 08 8b 45 e0 8b 40 04 89 45 ec 8b 45 f8 0f b6 50 01 03 d0 8b c2 8b 78 02 8b 50 06 85 d2 74 07 8b 02 89 45 e4 eb 05 33 c0 89 45 e4
                                                                                        Data Ascii: t7D;uC@u;uzuGMu$$Z]_^[SVC3;u63>33^[USVWMUEEEE}EU`3E}tmE@EEPxPtE3E
                                                                                        2022-07-25 13:17:42 UTC40INData Raw: 3b e8 74 05 e8 a5 bd ff ff 83 44 24 10 08 83 7c 24 10 00 7d 05 e8 94 bd ff ff 8b 06 89 44 24 18 8b 44 24 0c 89 44 24 14 8d 44 24 14 50 8b c6 b9 01 00 00 00 8b 54 24 04 e8 e9 fa ff ff 3b 5c 24 18 75 02 8b 1e 85 ff 74 1b 8b 44 24 04 f7 ed 8b 16 8d 04 02 8b 54 24 08 52 8b cf 8b d3 e8 e4 f6 ff ff eb 18 8b 44 24 04 f7 ed 8b 16 03 d0 8b 4c 24 08 0f af cd 8b c3 e8 06 b7 ff ff 83 c4 1c 5d 5f 5e 5b c3 8b c0 55 8b ec 83 c4 e4 53 56 57 89 4d f8 89 55 fc 8b d8 83 3b 00 0f 84 cc 00 00 00 8b 03 83 e8 08 8b 40 04 83 7d fc 00 0f 8c ba 00 00 00 3b 45 fc 0f 8e b1 00 00 00 83 7d f8 00 0f 8e a7 00 00 00 8b d0 2b 55 fc 2b 55 f8 89 55 f4 83 7d f4 00 7d 05 33 d2 89 55 f4 8b 55 08 0f b6 7a 01 03 fa 8b d7 8b 72 02 83 7a 06 00 74 07 8b 52 06 8b 3a eb 02 33 ff 8b 55 fc 0f af d6 8b
                                                                                        Data Ascii: ;tD$|$}D$D$D$D$PT$;\$utD$T$RD$L$]_^[USVWMU;@};E}+U+UU}}3UUzrztR:3U
                                                                                        2022-07-25 13:17:42 UTC41INData Raw: dc a3 40 00 64 ff 30 64 89 20 8b 45 fc 85 c0 74 05 83 e8 04 8b 00 83 f8 01 7c 15 8b 55 fc 66 83 7c 42 fe 2d 75 05 8b d8 4b eb 07 48 85 c0 75 eb 33 db 33 c0 5a 59 59 64 89 10 68 e3 a3 40 00 8d 45 fc e8 45 d6 ff ff c3 e9 5b cc ff ff eb f0 8b c3 5b 59 5d c3 8d 40 00 55 8b ec 6a 00 6a 00 6a 00 53 56 8b da 8b f0 33 c0 55 68 af a4 40 00 64 ff 30 64 89 20 8b c3 8b d6 e8 0e e1 ff ff 8b 03 85 c0 74 05 83 e8 04 8b 00 85 c0 7e 13 ba 01 00 00 00 8b 0b 66 83 7c 51 fe 2c 74 64 42 48 75 f2 8d 45 f8 8b 13 e8 0a da ff ff 8b c3 e8 db d5 ff ff eb 47 ff 33 ff 75 fc ff 75 f8 8b c3 ba 03 00 00 00 e8 69 e3 ff ff 8d 45 fc ba c8 a4 40 00 e8 e0 d9 ff ff 8d 45 f4 50 8b 45 f8 e8 0c ff ff ff 8b c8 ba 01 00 00 00 8b 45 f8 e8 29 e4 ff ff 8b 55 f4 8d 45 f8 e8 ba d9 ff ff 83 7d f8 00 75
                                                                                        Data Ascii: @d0d Et|Uf|B-uKHu33ZYYdh@EE[[Y]@UjjjSV3Uh@d0d t~f|Q,tdBHuEG3uuiE@EPEE)UE}u
                                                                                        2022-07-25 13:17:42 UTC42INData Raw: 02 00 ff ff ff ff 01 00 00 00 2c 00 00 00 53 56 8b d8 eb 08 53 e8 40 8e ff ff 8b d8 0f b7 33 66 85 f6 74 06 66 83 fe 5c 75 ea 8b c3 5e 5b c3 8d 40 00 55 8b ec 81 c4 94 fb ff ff 53 56 57 89 55 f8 89 45 fc 8b 45 fc 89 45 f4 68 e8 aa 40 00 e8 a6 8d ff ff 8b f0 85 f6 74 3d 68 04 ab 40 00 56 e8 9d 8d ff ff 89 c3 85 db 74 2c 68 05 01 00 00 8d 85 96 fb ff ff 50 8b 45 fc 50 ff d3 85 c0 74 16 8d 8d 96 fb ff ff 8b 55 f8 8b 45 fc e8 c4 f9 ff ff e9 51 01 00 00 8b 45 fc 66 83 38 5c 75 3b 8b 45 fc 66 83 78 02 5c 0f 85 3a 01 00 00 8b 45 fc 83 c0 04 e8 55 ff ff ff 8b f0 66 83 3e 00 0f 84 23 01 00 00 8d 46 02 e8 41 ff ff ff 8b f0 66 83 3e 00 0f 84 0f 01 00 00 eb 06 8b 75 fc 83 c6 04 8b de 2b 5d fc d1 fb 79 03 83 d3 00 8d 43 01 3d 05 01 00 00 0f 8f ed 00 00 00 8b d0 8d 85
                                                                                        Data Ascii: ,SVS@3ftf\u^[@USVWUEEEh@t=h@Vt,hPEPtUEQEf8\u;Efx\:EUf>#FAf>u+]yC=
                                                                                        2022-07-25 13:17:42 UTC44INData Raw: fc 8b c6 e8 b8 fc ff ff 8b 45 fc e8 30 00 00 00 8b c3 8b 15 10 7c 4b 00 e8 db d6 ff ff 33 c0 5a 59 59 64 89 10 68 92 ae 40 00 8d 45 fc e8 96 cb ff ff c3 e9 ac c1 ff ff eb f0 5e 5b 59 5d c3 90 53 56 57 8b f0 83 3d 10 7c 4b 00 00 74 0a a1 10 7c 4b 00 e8 bc 93 ff ff 8b c6 85 c0 74 05 83 e8 04 8b 00 8b d8 85 db 7e 27 43 8b fb 03 ff 8b c7 e8 1b 90 ff ff a3 10 7c 4b 00 8b c6 e8 13 d6 ff ff 8b 15 10 7c 4b 00 8b cf e8 ce a6 ff ff eb 07 33 c0 a3 10 7c 4b 00 5f 5e 5b c3 90 55 8b ec 81 c4 ac fd ff ff 53 89 45 fc 8b 45 fc e8 fb cb ff ff 33 c0 55 68 52 af 40 00 64 ff 30 64 89 20 8d 85 ac fd ff ff 50 8b 45 fc e8 c6 d5 ff ff 50 e8 34 87 ff ff 83 f8 ff 0f 95 c3 84 db 74 06 50 e8 1c 87 ff ff 33 c0 5a 59 59 64 89 10 68 59 af 40 00 8d 45 fc e8 cf ca ff ff c3 e9 e5 c0 ff ff
                                                                                        Data Ascii: E0|K3ZYYdh@E^[Y]SVW=|Kt|Kt~'C|K|K3|K_^[USEE3UhR@d0d PEP4tP3ZYYdhY@E
                                                                                        2022-07-25 13:17:42 UTC45INData Raw: ff 53 04 33 c0 5a 59 59 64 89 10 eb 0a e9 bc b9 ff ff e8 0f be ff ff 8b 45 f8 8b 00 89 45 f8 83 7d f8 00 75 c7 5f 5e 5b 59 59 5d c3 8b c0 8b 15 44 70 4b 00 85 d2 74 0a 3b c2 74 13 8b 12 85 d2 75 f6 8b 15 44 70 4b 00 89 10 a3 44 70 4b 00 c3 8b c0 55 8b ec 51 89 45 fc 33 d2 55 68 70 b4 40 00 64 ff 32 64 89 22 8b 45 fc 8b 40 04 e8 60 ff ff ff 33 c0 5a 59 59 64 89 10 68 77 b4 40 00 8b 45 fc 3b 05 44 70 4b 00 75 0c 8b 45 fc 8b 00 a3 44 70 4b 00 eb 1f a1 44 70 4b 00 85 c0 74 16 8b 10 3b 55 fc 75 09 8b 55 fc 8b 12 89 10 eb 06 8b 00 85 c0 75 ea c3 e9 c7 bb ff ff eb c2 59 5d c3 8b c0 8b 10 85 d2 74 0e c7 00 00 00 00 00 50 52 8b 02 ff 50 08 58 c3 8d 40 00 85 d2 74 19 52 50 8b 02 52 ff 50 04 58 8b 08 8f 00 85 c9 75 01 c3 8b 01 51 ff 50 08 c3 8b 08 85 c9 89 10 74 06
                                                                                        Data Ascii: S3ZYYdEE}u_^[YY]DpKt;tuDpKDpKUQE3Uhp@d2d"E@`3ZYYdhw@E;DpKuEDpKDpKt;UuUuY]tPRPX@tRPRPXuQPt
                                                                                        2022-07-25 13:17:42 UTC46INData Raw: 07 44 65 73 74 72 6f 79 00 00 00 00 00 00 01 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 dc c1 40 00 0a 49 6e 69 74 69 61 6c 69 7a 65 00 00 00 00 00 00 00 02 00 08 98 c1 40 00 08 46 69 6e 61 6c 69 7a 65 00 00 00 00 00 00 00 02 00 08 38 c3 40 00 0f 52 65 67 69 73 74 65 72 57 65 61 6b 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 14 c4 40 00 11 55 6e 72 65 67 69 73 74 65 72 57 65 61 6b 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 18 7c 4b 00 15 52 65 67 69 73 74 65 72 57 65 61 6b 4d 65 74 68 6f 64 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00
                                                                                        Data Ascii: Destroy@Instance@Initialize@Finalize8@RegisterWeakRef@Address@Instance@UnregisterWeakRef@Address@Instance|KRegisterWeakMethodRef@Address
                                                                                        2022-07-25 13:17:42 UTC48INData Raw: f2 8b d8 8b 43 08 85 c0 74 05 83 e8 04 8b 00 85 c0 75 0f 8d 43 08 ba 0a 00 00 00 e8 a6 fc ff ff eb 29 8b 43 08 85 c0 74 05 83 e8 04 8b 00 3b 43 04 75 18 8b 43 08 85 c0 74 05 83 e8 04 8b 00 8b d0 03 d2 8d 43 08 e8 7b fc ff ff 8b 43 04 3b f0 7c 08 8b 53 08 89 3c 82 eb 1f 8b 53 08 8d 54 b2 04 8b 4b 08 8d 0c b1 2b c6 03 c0 03 c0 91 e8 c3 96 ff ff 8b 43 08 89 3c b0 ff 43 04 5f 5e 5b c3 8b c0 53 56 57 83 c4 f4 89 0c 24 33 c9 89 4c 24 04 8b 48 04 85 c9 7e 47 33 f6 8b f9 4f 3b fe 7c 37 8d 1c 37 d1 eb 8b 48 08 8b 0c 99 89 4c 24 08 8b 4c 24 08 8b 09 2b ca 85 c9 7d 05 8d 73 01 eb 13 8b fb 4f 85 c9 75 0c 8b 48 08 8b 0c 99 89 4c 24 04 8b f3 3b fe 7d c9 8b 04 24 89 30 eb 07 8b 04 24 33 d2 89 10 8b 44 24 04 83 c4 0c 5f 5e 5b c3 90 53 56 57 8b f0 8b 5e 04 4b 85 db 7c 12
                                                                                        Data Ascii: CtuC)Ct;CuCtC{C;|S<STK+C<C_^[SVW$3L$H~G3O;|77HL$L$+}sOuHL$;}$0$3D$_^[SVW^K|
                                                                                        2022-07-25 13:17:42 UTC49INData Raw: 8b 55 fc 8d 44 82 14 e8 38 fc ff ff c3 e9 4a ac ff ff eb e6 8b 45 ec 89 45 e8 8b 45 e8 8d 50 08 8b 45 e8 8b 4d f8 e8 0d f9 ff ff 5e 5b 8b e5 5d c3 8d 40 00 55 8b ec 83 c4 e8 53 56 8b d9 89 55 f8 89 45 fc 8b 45 fc 80 b8 50 09 00 00 00 0f 84 8f 00 00 00 8b cb 8b c1 c1 e8 0d c1 e9 05 03 c1 b9 c5 00 00 00 99 f7 f9 89 55 f4 8b 75 f4 8d 34 76 8b 45 fc 8d 44 b0 14 e8 5f fb ff ff 33 d2 55 68 9f c4 40 00 64 ff 32 64 89 22 8b 45 fc 8d 44 b0 14 8d 4d f0 8b d3 e8 84 fa ff ff 89 45 ec 33 c0 5a 59 59 64 89 10 68 a6 c4 40 00 8b 45 f4 8d 04 40 8b 55 fc 8d 44 82 14 e8 86 fb ff ff c3 e9 98 ab ff ff eb e6 83 7d ec 00 74 17 8b 45 ec 89 45 e8 8b 45 e8 8d 50 08 8b 45 e8 8b 4d f8 e8 21 f9 ff ff 5e 5b 8b e5 5d c3 8d 40 00 e8 1b a4 ff ff f0 0f ba 28 00 c3 90 53 56 57 8b da 8b f8
                                                                                        Data Ascii: UD8JEEEPEM^[]@USVUEEPUu4vED_3Uh@d2d"EDME3ZYYdh@E@UD}tEEEPEM!^[]@(SVW
                                                                                        2022-07-25 13:17:42 UTC50INData Raw: f0 8b de 85 db 74 05 83 eb 04 8b 1b 53 8b c6 e8 2e bc ff ff 8b c8 8d 47 01 ba ff 00 00 00 e8 cb fd ff ff 48 85 c0 7d 02 33 c0 88 07 5f 5e 5b c3 8b c0 55 8b ec 81 c4 fc fe ff ff 53 56 57 33 c9 89 4d fc 8b f0 8d bd fc fe ff ff 0f b6 0e 41 f3 a4 8b f2 33 c0 55 68 7e c9 40 00 64 ff 30 64 89 20 8b c6 e8 0e b1 ff ff 80 bd fc fe ff ff 00 74 4d 0f b6 9d fc fe ff ff 8d 45 fc 8b d3 e8 38 bd ff ff 53 8b 45 fc e8 b7 bb ff ff 8d 8d fd fe ff ff 8d 53 01 e8 f5 fd ff ff 8b d8 85 db 7e 0d 8b d3 4a 8d 45 fc e8 10 bd ff ff eb 08 8d 45 fc e8 c2 b0 ff ff 8b c6 8b 55 fc e8 98 b4 ff ff 33 c0 5a 59 59 64 89 10 68 85 c9 40 00 8d 45 fc e8 a3 b0 ff ff c3 e9 b9 a6 ff ff eb f0 5f 5e 5b 8b e5 5d c3 53 56 57 81 c4 00 ff ff ff 8b f0 8d 3c 24 0f b6 0e 41 f3 a4 8b da 8b d3 8b c4 e8 31 ff
                                                                                        Data Ascii: tS.GH}3_^[USVW3MA3Uh~@d0d tME8SES~JEEU3ZYYdh@E_^[]SVW<$A1
                                                                                        2022-07-25 13:17:42 UTC52INData Raw: e8 9b fe ff ff e8 96 fe ff ff e8 91 fe ff ff e8 8c fe ff ff e8 87 fe ff ff e8 82 fe ff ff e8 7d fe ff ff e8 78 fe ff ff e8 73 fe ff ff e8 6e fe ff ff e8 69 fe ff ff e8 64 fe ff ff e8 5f fe ff ff e8 5a fe ff ff e8 55 fe ff ff e8 50 fe ff ff e8 4b fe ff ff e8 46 fe ff ff e8 41 fe ff ff e8 3c fe ff ff e8 37 fe ff ff e8 32 fe ff ff e8 2d fe ff ff e8 28 fe ff ff e8 23 fe ff ff e8 1e fe ff ff e8 19 fe ff ff e8 14 fe ff ff e8 0f fe ff ff e8 0a fe ff ff e8 05 fe ff ff e8 00 fe ff ff e8 fb fd ff ff e8 f6 fd ff ff e8 f1 fd ff ff e8 ec fd ff ff e8 e7 fd ff ff e8 e2 fd ff ff e8 dd fd ff ff e8 d8 fd ff ff e8 d3 fd ff ff e8 ce fd ff ff e8 c9 fd ff ff e8 c4 fd ff ff e8 bf fd ff ff e8 ba fd ff ff e8 b5 fd ff ff e8 b0 fd ff ff e8 ab fd ff ff e8 a6 fd ff ff e8 a1 fd ff ff
                                                                                        Data Ascii: }xsnid_ZUPKFA<72-(#
                                                                                        2022-07-25 13:17:42 UTC53INData Raw: db 75 0b 8b 45 b4 50 e8 6e f8 ff ff 8b d8 85 db 75 4b e8 5b f8 ff ff 89 45 c8 83 3d 44 e6 4b 00 00 74 0e 8d 45 a8 50 6a 03 ff 15 44 e6 4b 00 8b d8 85 db 75 28 a1 88 7c 4b 00 89 45 f4 8d 55 a8 89 55 f4 8d 4d f4 51 6a 01 6a 00 68 7e 00 6d c0 e8 2d f8 ff ff 8b 45 c4 e9 21 01 00 00 53 8b 55 d4 52 e8 cb f7 ff ff 3b d8 74 33 83 7e 18 00 74 33 6a 08 6a 40 e8 d8 f7 ff ff 89 45 f0 85 c0 74 23 8b c6 8b 55 f0 89 42 04 8b 4d f0 a1 3c 7c 4b 00 89 01 8b 55 f0 89 15 3c 7c 4b 00 eb 06 53 e8 9e f7 ff ff 89 5d c0 83 3d 40 e6 4b 00 00 74 0e 8d 4d a8 51 6a 02 ff 15 40 e6 4b 00 8b f8 85 ff 75 4b 83 7e 14 00 74 39 83 7e 1c 00 74 33 8b 43 3c 03 c3 81 38 50 45 00 00 75 26 8b 50 08 3b 55 e8 75 1e 8b 48 34 3b cb 0f 94 c1 83 e1 01 84 c9 74 0f 8b 45 e0 8b 55 f8 8b 3c 90 85 ff 74 02
                                                                                        Data Ascii: uEPnuK[E=DKtEPjDKu(|KEUUMQjjh~m-E!SUR;t3~t3jj@Et#UBM<|KU<|KS]=@KtMQj@KuK~t9~t3C<8PEu&P;UuH4;tEU<t
                                                                                        2022-07-25 13:17:42 UTC54INData Raw: 6f 6d 42 65 67 69 6e 6e 69 6e 67 07 46 72 6f 6d 45 6e 64 0c 53 79 73 74 65 6d 2e 54 79 70 65 73 02 00 00 00 f8 d8 40 00 03 0b 54 57 61 69 74 52 65 73 75 6c 74 01 00 00 00 00 04 00 00 00 f4 d8 40 00 0a 77 72 53 69 67 6e 61 6c 65 64 09 77 72 54 69 6d 65 6f 75 74 0b 77 72 41 62 61 6e 64 6f 6e 65 64 07 77 72 45 72 72 6f 72 0e 77 72 49 4f 43 6f 6d 70 6c 65 74 69 6f 6e 0c 53 79 73 74 65 6d 2e 54 79 70 65 73 02 00 00 00 00 60 d9 40 00 03 1b 54 4d 75 6c 74 69 57 61 69 74 45 76 65 6e 74 2e 54 57 61 69 74 65 72 46 6c 61 67 01 00 00 00 00 01 00 00 00 5c d9 40 00 07 57 61 69 74 69 6e 67 07 57 61 69 74 41 6c 6c 0c 53 79 73 74 65 6d 2e 54 79 70 65 73 02 00 00 00 00 b0 d9 40 00 06 1c 54 4d 75 6c 74 69 57 61 69 74 45 76 65 6e 74 2e 54 57 61 69 74 65 72 46 6c 61 67 73 01
                                                                                        Data Ascii: omBeginningFromEndSystem.Types@TWaitResult@wrSignaledwrTimeoutwrAbandonedwrErrorwrIOCompletionSystem.Types`@TMultiWaitEvent.TWaiterFlag\@WaitingWaitAllSystem.Types@TMultiWaitEvent.TWaiterFlags
                                                                                        2022-07-25 13:17:42 UTC56INData Raw: 00 18 7c 4b 00 0a 57 61 69 74 46 6f 72 41 6e 79 03 00 f4 d8 40 00 0c 00 03 16 cc de 40 00 00 00 06 45 76 65 6e 74 73 02 00 20 9c 10 40 00 02 00 05 49 6e 64 65 78 02 00 00 e4 10 40 00 08 00 07 54 69 6d 65 6f 75 74 02 00 02 00 4c 00 18 7c 4b 00 0a 57 61 69 74 46 6f 72 41 6e 79 03 00 f4 d8 40 00 0c 00 03 16 cc de 40 00 00 00 06 45 76 65 6e 74 73 02 00 28 cc de 40 00 02 00 05 45 76 65 6e 74 02 00 00 e4 10 40 00 08 00 07 54 69 6d 65 6f 75 74 02 00 02 00 00 00 00 d0 de 40 00 07 0f 54 4d 75 6c 74 69 57 61 69 74 45 76 65 6e 74 5c dc 40 00 88 1f 40 00 00 00 0c 53 79 73 74 65 6d 2e 54 79 70 65 73 00 00 00 00 02 00 00 00 04 df 40 00 0f 0c 49 41 73 79 6e 63 52 65 73 75 6c 74 b0 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 53 79 73 74 65 6d 2e 54 79
                                                                                        Data Ascii: |KWaitForAny@@Events @Index@TimeoutL|KWaitForAny@@Events(@Event@Timeout@TMultiWaitEvent\@@System.Types@IAsyncResult&@System.Ty
                                                                                        2022-07-25 13:17:42 UTC57INData Raw: 4c 00 8b c0 ff 25 f8 22 4c 00 8b c0 ff 25 78 23 4c 00 8b c0 ff 25 7c 23 4c 00 8b c0 ff 25 28 24 4c 00 8b c0 ff 25 fc 23 4c 00 8b c0 ff 25 2c 24 4c 00 8b c0 ff 25 84 24 4c 00 8b c0 ff 25 7c 24 4c 00 8b c0 ff 25 80 24 4c 00 8b c0 ff 25 98 24 4c 00 8b c0 ff 25 94 24 4c 00 8b c0 ff 25 9c 24 4c 00 8b c0 ff 25 b4 24 4c 00 8b c0 ff 25 b0 24 4c 00 8b c0 ff 25 c8 24 4c 00 8b c0 ff 25 c4 24 4c 00 8b c0 ff 25 a4 24 4c 00 8b c0 ff 25 c0 24 4c 00 8b c0 ff 25 ac 24 4c 00 8b c0 ff 25 bc 24 4c 00 8b c0 ff 25 a0 24 4c 00 8b c0 ff 25 90 24 4c 00 8b c0 ff 25 8c 24 4c 00 8b c0 55 8b ec 51 53 56 57 89 4d fc 8b fa 8b f0 e8 dd 72 ff ff 8b d8 8b 45 08 50 8b 45 0c 50 8b 45 10 50 8b 45 14 50 8b 45 18 50 8b 45 1c 50 8b 45 20 50 8b 45 24 50 8b 45 28 50 8b 45 fc 50 57 56 e8 b4 ff ff
                                                                                        Data Ascii: L%"L%x#L%|#L%($L%#L%,$L%$L%|$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$L%$LUQSVWMrEPEPEPEPEPEPE PE$PE(PEPWV
                                                                                        2022-07-25 13:17:42 UTC58INData Raw: 00 00 34 e6 4b 00 aa ff 00 00 34 e6 4b 00 ab ff 00 00 34 e6 4b 00 ac ff 00 00 34 e6 4b 00 ad ff 00 00 34 e6 4b 00 ae ff 00 00 34 e6 4b 00 af ff 00 00 34 e6 4b 00 90 ff 00 00 34 e6 4b 00 91 ff 00 00 34 e6 4b 00 92 ff 00 00 34 e6 4b 00 93 ff 00 00 34 e6 4b 00 94 ff 00 00 34 e6 4b 00 95 ff 00 00 34 e6 4b 00 96 ff 00 00 34 e6 4b 00 97 ff 00 00 34 e6 4b 00 98 ff 00 00 34 e6 4b 00 99 ff 00 00 34 e6 4b 00 9a ff 00 00 34 e6 4b 00 9b ff 00 00 34 e6 4b 00 9c ff 00 00 34 e6 4b 00 9d ff 00 00 34 e6 4b 00 9e ff 00 00 ff 05 70 e6 4b 00 75 1b 83 3d 74 e6 4b 00 00 74 12 a1 74 e6 4b 00 50 e8 3c f7 ff ff 33 c0 a3 74 e6 4b 00 c3 34 e6 4b 00 9f ff 00 00 34 e6 4b 00 80 ff 00 00 34 e6 4b 00 81 ff 00 00 34 e6 4b 00 82 ff 00 00 34 e6 4b 00 83 ff 00 00 34 e6 4b 00 84 ff 00 00 34
                                                                                        Data Ascii: 4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4K4KpKu=tKttKP<3tK4K4K4K4K4K4K4
                                                                                        2022-07-25 13:17:42 UTC60INData Raw: 11 11 11 11 8a 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 8b 8c 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 8d 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 8e 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 11 11 8f 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d
                                                                                        Data Ascii: ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
                                                                                        2022-07-25 13:17:42 UTC61INData Raw: 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d
                                                                                        Data Ascii: ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
                                                                                        2022-07-25 13:17:42 UTC62INData Raw: 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 90 91 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d 5d
                                                                                        Data Ascii: ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
                                                                                        2022-07-25 13:17:42 UTC64INData Raw: d5 05 b4 16 00 05 00 05 c3 03 c4 01 fd 03 9d 0a 72 0c aa 02 00 05 00 05 22 04 3a 12 0f 14 67 04 4c 03 c4 01 c7 01 74 09 f7 15 6c 09 8b 13 9f 13 44 12 e4 05 00 05 00 05 c4 01 c4 01 3d 16 f9 0f bb 15 34 0d 38 03 e5 01 63 03 7e 15 41 00 41 00 37 15 61 00 61 00 6b 06 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 b3 03 1e 0f c4 01 c4 01 b3 03 c4 01 c4 01 26 0f 21 0e 4d 03 c4 01 c4 01 c4 01 21 0e c4 01 c4 01 c4 01 66 02 32 09 44 05 c4 01 15 16 41 00 41 00 41 00 41 00 41 00 4d 14 8b 04 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 ea 01 c4 01 51 04 be 0f c4 01 c4 01 c4 01 c4 01 3b 07 bf 04 47 03 e1 07 c4 01 21
                                                                                        Data Ascii: r":gLtlD=48c~AA7aak&!M!f2DAAAAAMQ;G!
                                                                                        2022-07-25 13:17:42 UTC65INData Raw: 82 0c c4 01 69 0a c4 01 c4 01 c4 01 07 10 fd 04 8f 10 9e 0c af 04 a1 01 37 02 c3 05 61 00 61 00 dc 0c f6 06 61 00 61 00 61 00 61 00 61 00 c4 01 c4 01 f8 0c e5 04 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 04 c4 01 cd 01 c4 01 c4 01 c8 01 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 08 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d 18 0d c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c6 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 29 10 00 05 00 05 f7 06 b5 01 2a 0d 02 03 82 0d c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 59 0d 8d 03 ef 0a c4 01 c4 01 c4 01 c4 01 c4 01 29 0e 00 05 c4 01 c4 01 c4 01 c4 01 27 0e c4 01 c4 01 c0 04 00 05 00 05 de 0d 8b 13 64 07 8b 13 a0 08 ca
                                                                                        Data Ascii: i7aaaaaaa)*Y)'d
                                                                                        2022-07-25 13:17:42 UTC66INData Raw: e5 04 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 c4 01 0a 13 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 41 05 96 14 07 01 1d 16 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 29 10 00 05 00 05 00 05 00 05 00 05 00 05 08 0b 08 0b 08 0b 08 0b 08 0b 08 0b 09 0b d3 10 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 01 c4 04 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 c4 01 c4 01 c5 01 b6 11 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 c4 01 c4 01 c4 01 c4 01 c1 04 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 c4 01 c4 01 c4 01 2a 10 c4 01 c5 01 2f 0c 00 05 00 05 00
                                                                                        Data Ascii: A)*/
                                                                                        2022-07-25 13:17:42 UTC82INData Raw: 00 00 00 00 00 58 bb 40 00 00 00 00 00 40 bf 40 00 00 00 00 00 94 c1 40 00 00 00 00 00 88 d3 40 00 00 00 00 00 4c dd 40 00 00 00 00 00 88 e3 40 00 00 00 00 00 4c ed 40 00 00 00 00 00 17 f1 40 00 00 00 00 00 88 f3 40 00 00 00 00 00 f9 f5 40 55 55 55 55 55 55 ed 3f 00 00 00 00 00 6a 08 41 00 00 00 00 80 4f 12 41 00 00 00 00 00 6a 18 41 00 00 00 00 80 84 1e 41 00 00 00 00 80 4f 22 41 00 00 00 00 c0 5c 25 41 00 00 00 00 00 6a 28 41 00 00 00 00 40 77 2b 41 55 55 55 55 55 55 b5 3f ab aa aa aa aa aa da 3f ab aa aa aa aa aa e2 3f 9a 99 99 99 99 99 69 3f 9a 99 99 99 99 99 89 3f 00 00 00 00 00 00 90 3f 00 00 00 00 00 00 a0 3f 00 00 00 00 00 00 a8 3f 00 00 00 00 00 5e 0a 41 00 00 00 00 00 5e 1a 41 00 00 00 00 80 84 2e 41 00 00 00 00 84 d7 97 41 00 00 00 20 5f a0 02
                                                                                        Data Ascii: X@@@@@L@@L@@@@UUUUUU?jAOAjAAO"A\%Aj(A@w+AUUUUUU???i?????^A^A.AA _
                                                                                        2022-07-25 13:17:42 UTC98INData Raw: 73 02 00 00 9c 10 40 00 18 00 09 42 79 74 65 49 6e 64 65 78 02 00 00 9c 10 40 00 14 00 09 42 79 74 65 43 6f 75 6e 74 02 00 16 4c 10 40 00 10 00 05 43 68 61 72 73 02 00 00 9c 10 40 00 08 00 09 43 68 61 72 49 6e 64 65 78 02 00 02 00 7f 00 18 7c 4b 00 08 47 65 74 43 68 61 72 73 03 00 9c 10 40 00 14 00 06 08 84 8b 41 00 00 00 04 53 65 6c 66 02 00 02 a4 31 40 00 01 00 05 42 79 74 65 73 02 00 00 9c 10 40 00 02 00 09 42 79 74 65 49 6e 64 65 78 02 00 00 9c 10 40 00 10 00 09 42 79 74 65 43 6f 75 6e 74 02 00 02 dc 31 40 00 0c 00 05 43 68 61 72 73 02 00 00 9c 10 40 00 08 00 09 43 68 61 72 49 6e 64 65 78 02 00 02 00 2f 00 18 7c 4b 00 0b 47 65 74 45 6e 63 6f 64 69 6e 67 03 00 84 8b 41 00 08 00 01 00 9c 10 40 00 00 00 08 43 6f 64 65 50 61 67 65 02 00 02 00 33 00 18 7c
                                                                                        Data Ascii: s@ByteIndex@ByteCountL@Chars@CharIndex|KGetChars@ASelf1@Bytes@ByteIndex@ByteCount1@Chars@CharIndex/|KGetEncodingA@CodePage3|
                                                                                        2022-07-25 13:17:42 UTC114INData Raw: 00 00 55 8b ec 83 c4 d0 53 56 57 33 d2 89 55 d0 89 55 d4 89 45 ec 33 c0 55 68 16 d1 41 00 64 ff 30 64 89 20 83 7d ec 00 0f 84 23 08 00 00 8b 45 08 83 b8 28 fd ff ff 02 0f 8d 13 08 00 00 8b 45 08 ff 80 28 fd ff ff 66 c7 45 e0 20 00 c6 45 e3 00 c6 45 e2 00 c6 45 df 00 e9 db 07 00 00 66 89 75 ea 66 81 7d ea 00 d8 72 3c 66 81 7d ea ff df 77 34 8b 45 08 50 8b 45 ec e8 c8 39 00 00 8b d0 d1 fa 79 03 83 d2 00 8b 45 ec e8 e3 fa ff ff 59 8b 45 ec e8 de 39 00 00 89 45 ec 66 c7 45 e0 20 00 e9 93 07 00 00 8b 45 ec e8 c8 39 00 00 89 45 ec 0f b7 5d ea 8b c3 83 c0 9f 66 83 e8 1a 73 04 66 83 eb 20 8b c3 83 c0 bf 66 83 e8 1a 73 15 66 83 fb 4d 75 0b 66 83 7d e0 48 75 04 66 bb 4e 00 66 89 5d e0 0f b7 c3 83 c0 de 83 f8 38 0f 87 34 07 00 00 0f b6 80 ab c9 41 00 ff 24 85 e4 c9
                                                                                        Data Ascii: USVW3UUE3UhAd0d }#E(E(fE EEEfuf}r<f}w4EPE9yEYE9EfE E9E]fsf fsfMuf}HufNf]84A$
                                                                                        2022-07-25 13:17:42 UTC130INData Raw: 40 00 53 56 57 55 81 c4 f8 fd ff ff 8b d8 8b c3 e8 31 76 fe ff 8b e8 55 6a 00 6a 00 8b cb 33 d2 b8 e9 fd 00 00 e8 b0 c1 fe ff 8b f8 81 ff 04 01 00 00 76 0d 8b c7 03 c0 e8 09 4b fe ff 8b f0 eb 02 8b f4 55 56 57 8b cb 33 d2 b8 e9 fd 00 00 e8 86 c1 fe ff 56 e8 ec da fe ff 33 db 8b c7 48 85 c0 7c 19 40 33 d2 8b cb c1 e1 05 c1 eb 1b 0b cb 8b d9 0f b7 0c 56 33 d9 42 48 75 ea 8b c4 3b f0 74 07 8b c6 e8 d9 4a fe ff 8b c3 81 c4 08 02 00 00 5d 5f 5e 5b c3 56 53 89 c6 31 c0 56 c1 c0 05 8a 1e f6 c3 80 75 1b 80 fb 00 74 12 80 fb 41 7c 08 80 fb 5a 7f 03 80 cb 20 32 c3 46 eb df 59 5b 5e c3 58 5b 5e e9 38 ff ff ff c3 8d 40 00 53 8b 1d 00 a7 4b 00 8b 1b 85 db 74 1f 83 7b 18 00 74 13 8b 43 18 8b 15 08 08 42 00 e8 cf 8b fe ff 33 c0 89 43 18 8b 1b 85 db 75 e1 5b c3 8b c0 53
                                                                                        Data Ascii: @SVWU1vUjj3vKUVW3V3H|@3V3BHu;tJ]_^[VS1VutA|Z 2FY[^X[^8@SKt{tCB3Cu[S
                                                                                        2022-07-25 13:17:42 UTC146INData Raw: aa 1a fe ff 8b da 8b f0 8b 46 04 e8 2e 14 fe ff 80 7e 10 00 74 1d 8b d4 8b 46 08 8b 08 ff 11 8b 56 0c 8b c4 e8 81 dd ff ff 8b d4 8b 46 08 8b 08 ff 51 0c b2 fc 22 d3 8b c6 e8 f0 13 fe ff 84 db 7e 07 8b c6 e8 0d 1a fe ff 59 5a 5e 5b c3 53 56 51 8b d8 83 7b 0c 05 73 16 b9 8c 49 42 00 b2 01 a1 dc 3f 42 00 e8 50 a9 ff ff e8 03 28 fe ff 8b d4 8b 43 08 b9 04 00 00 00 e8 98 f3 ff ff 83 6b 0c 04 8b 73 0c 81 fe 00 10 00 00 76 05 be 00 10 00 00 8d 53 1c 8b 43 08 8b ce e8 77 f3 ff ff 29 73 0c 33 c0 89 43 14 89 73 18 8d 43 1c 8b d6 e8 ce fc ff ff 3b 04 24 74 16 b9 8c 49 42 00 b2 01 a1 dc 3f 42 00 e8 f0 a8 ff ff e8 a3 27 fe ff 5a 5e 5b c3 00 00 00 b0 04 02 00 ff ff ff ff 1d 00 00 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 65 00 64 00 20 00 62 00 6c 00 6f 00 63
                                                                                        Data Ascii: F.~tFVFQ"~YZ^[SVQ{sIB?BP(CksvSCw)s3CsC;$tIB?B'Z^[Compressed bloc
                                                                                        2022-07-25 13:17:42 UTC162INData Raw: 74 73 00 00 00 00 02 00 00 00 0c 89 42 00 00 00 00 00 00 00 00 00 00 00 00 00 38 89 42 00 00 00 00 00 14 89 42 00 00 00 00 00 1a 89 42 00 1c 00 00 00 64 66 41 00 b0 5d 40 00 b8 5d 40 00 c0 f4 41 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 f0 f3 41 00 68 f4 41 00 34 f4 41 00 00 00 00 00 02 00 17 45 56 61 72 69 61 6e 74 55 6e 65 78 70 65 63 74 65 64 45 72 72 6f 72 00 00 38 89 42 00 07 17 45 56 61 72 69 61 6e 74 55 6e 65 78 70 65 63 74 65 64 45 72 72 6f 72 0c 89 42 00 d8 66 41 00 00 00 0f 53 79 73 74 65 6d 2e 56 61 72 69 61 6e 74 73 00 00 00 00 02 00 00 00 00 cc 89 42 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 89 42 00 00 00 00 00 d4 89 42 00 00 00 00 00 da 89 42 00 1c 00 00 00 64 66 41 00 b0 5d 40 00 b8 5d 40 00 c0
                                                                                        Data Ascii: tsB8BBBdfA]@]@A`@,`@0`@4`@(`@\@\@AhA4AEVariantUnexpectedError8BEVariantUnexpectedErrorBfASystem.VariantsBBBBdfA]@]@
                                                                                        2022-07-25 13:17:42 UTC178INData Raw: ec 83 c4 e4 89 45 f4 8d 45 e4 50 e8 8a a9 ff ff 33 c0 55 68 fe c8 42 00 64 ff 30 64 89 20 8b 55 f4 8d 45 e4 e8 61 cd ff ff 8d 45 e4 ff 15 98 11 4c 00 8d 45 e4 e8 7c 00 00 00 df 7d f8 9b 33 c0 5a 59 59 64 89 10 68 05 c9 42 00 8d 45 e4 e8 7b c9 ff ff c3 e9 39 a7 fd ff eb f0 df 6d f8 8b e5 5d c3 53 56 57 83 c4 e8 8b f2 89 44 24 04 8b d4 8b 44 24 04 0f b7 00 e8 3a 3f 00 00 8b d8 84 db 74 2a 8d 44 24 08 50 e8 0e a9 ff ff 6a 06 8b 4c 24 08 8d 54 24 0c 8b 44 24 04 8b 38 ff 57 1c 8b 44 24 10 89 06 8b 44 24 14 89 46 04 8b c3 83 c4 18 5f 5e 5b c3 90 83 c4 e0 89 44 24 08 8b 44 24 08 0f b7 00 0f b7 d0 83 fa 0c 7f 46 0f 84 53 02 00 00 83 fa 0b 0f 87 a7 02 00 00 ff 24 95 8c c9 42 00 1e ca 42 00 2c ca 42 00 50 ca 42 00 66 ca 42 00 7c ca 42 00 7c ca 42 00 8e ca 42 00 a4
                                                                                        Data Ascii: EEP3UhBd0d UEaELE|}3ZYYdhBE{9m]SVWD$D$:?t*D$PjL$T$D$8WD$D$F_^[D$D$FS$BB,BPBfB|B|BB
                                                                                        2022-07-25 13:17:42 UTC194INData Raw: ff 31 64 89 21 a1 bc 17 4c 00 85 c0 74 05 83 e8 04 8b 00 0f b7 d3 8b ca 81 e9 00 01 00 00 3b c1 0f 9f 45 ff 80 7d ff 00 74 26 a1 bc 17 4c 00 8b 84 90 00 fc ff ff 89 06 83 3e 00 74 0a 8b 06 3b 05 bc 93 4b 00 75 04 33 c0 eb 02 b0 01 88 45 ff 33 c0 5a 59 59 64 89 10 68 19 09 43 00 a1 c0 17 4c 00 e8 57 5f fd ff c3 e9 25 67 fd ff eb ee 0f b6 45 ff 5e 5b 59 5d c3 8b c0 55 8b ec 83 c4 e8 53 56 57 33 c9 89 4d ec 89 55 fc 8b f8 33 c0 55 68 18 0a 43 00 64 ff 30 64 89 20 c6 45 fb 00 83 ca ff a1 c0 17 4c 00 e8 8a 5c fd ff 33 d2 55 68 fb 09 43 00 64 ff 32 64 89 22 a1 bc 17 4c 00 85 c0 74 05 83 e8 04 8b 00 48 85 c0 7c 6c 40 89 45 f0 c7 45 f4 00 00 00 00 a1 bc 17 4c 00 8b 55 f4 8b 34 90 85 f6 74 4a 3b 35 bc 93 4b 00 74 42 8d 55 ec 8b 06 e8 45 52 fd ff 8b 5d ec 3b df 75
                                                                                        Data Ascii: 1d!Lt;E}t&L>t;Ku3E3ZYYdhCLW_%gE^[Y]USVW3MU3UhCd0d EL\3UhCd2d"LtH|l@EELU4tJ;5KtBUER];u
                                                                                        2022-07-25 13:17:42 UTC210INData Raw: 00 00 00 80 ff ff 0c 50 72 6f 70 65 72 74 79 54 79 70 65 00 10 40 00 14 00 00 fe 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 0a 49 73 52 65 61 64 61 62 6c 65 00 10 40 00 18 00 00 fe 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 0a 49 73 57 72 69 74 61 62 6c 65 00 60 49 43 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 49 43 00 00 00 00 00 94 49 43 00 00 00 00 00 a2 49 43 00 1c 00 00 00 20 47 43 00 b0 5d 40 00 b8 5d 40 00 e8 a0 44 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 20 68 44 00 c8 67 44 00 d0 68 44 00 a8 9c 44 00 34 25 45 00 dc 9c 44 00 f4 9c 44 00 08 9d 44 00 1c 9d 44 00 c0 9e 44 00 88 9c 44 00 98 9c 44 00 cc 9c 44 00 b4 57 40 00 00 00 01 00 b8 49 43 00 4a 00 f7 ff 0d 00 15 54 52 74 74 69 49
                                                                                        Data Ascii: PropertyType@IsReadable@IsWritable`ICICICIC GC]@]@D`@,`@0`@4`@(`@\@\@ hDgDhDD4%EDDDDDDDDW@ICJTRttiI
                                                                                        2022-07-25 13:17:42 UTC226INData Raw: 01 00 00 00 30 84 43 00 1c 00 00 00 00 00 00 00 00 00 03 00 00 90 0d 43 00 04 00 00 00 0b 46 4c 69 73 74 48 65 6c 70 65 72 02 00 00 30 84 43 00 1c 00 00 00 09 46 43 6f 6d 70 61 72 65 72 02 00 00 a0 84 43 00 20 00 00 00 09 46 4f 6e 4e 6f 74 69 66 79 02 00 00 00 2c 00 98 8a 43 00 44 00 f4 ff be 8a 43 00 44 00 f4 ff f7 8a 43 00 44 00 f4 ff 31 8b 43 00 4d 00 ff ff 58 8b 43 00 4b 00 03 00 98 8b 43 00 43 00 f4 ff d8 8b 43 00 42 00 f4 ff 0a 8c 43 00 42 00 f4 ff 42 8c 43 00 42 00 f4 ff 7e 8c 43 00 42 00 f4 ff ba 8c 43 00 42 00 f4 ff fe 8c 43 00 42 00 f4 ff 57 8d 43 00 42 00 f4 ff a1 8d 43 00 42 00 f4 ff ef 8d 43 00 42 00 f4 ff 3d 8e 43 00 42 00 f4 ff 61 8e 43 00 42 00 f4 ff 96 8e 43 00 42 00 f4 ff cb 8e 43 00 42 00 f4 ff 17 8f 43 00 42 00 f4 ff 4c 8f 43 00 42 00
                                                                                        Data Ascii: 0CCFListHelper0CFComparerC FOnNotify,CDCDCD1CMXCKCCCBCBBCB~CBCBCBWCBCBCB=CBaCBCBCBCBLCB
                                                                                        2022-07-25 13:17:42 UTC242INData Raw: ff 8b f1 88 55 ff 8b d8 8b 7d 10 8b 45 0c 50 8b cf 33 d2 8b c3 e8 7c ff ff ff 0f b6 45 08 88 43 14 85 f6 74 0c 8b 53 10 8b c6 8b cf e8 d9 8c fc ff 8b c3 80 7d ff 00 74 0f e8 20 9a fc ff 64 8f 05 00 00 00 00 83 c4 0c 8b c3 5f 5e 5b 59 5d c2 0c 00 53 56 e8 55 9a fc ff 8b da 8b f0 8b 46 0c e8 69 f5 ff ff 84 c0 74 16 80 7e 14 00 75 10 8b 56 0c 8b 46 10 b9 01 00 00 00 e8 67 cc fc ff b2 fc 22 d3 8b c6 e8 a4 93 fc ff 84 db 7e 07 8b c6 e8 c1 99 fc ff 5e 5b c3 8b c0 8b 40 10 85 c0 74 05 83 e8 04 8b 00 c3 8d 40 00 53 56 8b f2 8b d8 8b 43 0c e8 16 f5 ff ff 84 c0 74 12 6a 01 8b 4b 0c 8b 53 10 8b c6 e8 03 cc fc ff 5e 5b c3 8b 43 10 85 c0 74 05 83 e8 04 8b 00 8b d6 8b 4b 10 91 e8 25 8c fc ff 5e 5b c3 8b c0 8b 48 10 85 c9 74 05 83 e9 04 8b 09 8b 40 10 e8 0c 8c fc ff c3
                                                                                        Data Ascii: U}EP3|ECtS}t d_^[Y]SVUFit~uVFg"~^[@t@SVCtjKS^[CtK%^[Ht@
                                                                                        2022-07-25 13:17:42 UTC258INData Raw: 74 69 6f 6e 17 54 43 6f 6c 6c 65 63 74 69 6f 6e 4e 6f 74 69 66 69 63 61 74 69 6f 6e 00 88 1f 40 00 b8 12 40 00 50 0c 43 00 b5 08 44 00 02 00 00 00 00 00 00 00 03 08 88 1f 40 00 06 53 65 6e 64 65 72 02 00 02 b8 12 40 00 04 49 74 65 6d 02 00 00 50 0c 43 00 06 41 63 74 69 6f 6e 02 00 e8 08 44 00 11 20 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 54 79 70 49 6e 66 6f 2e 50 54 79 70 65 49 6e 66 6f 3e 04 00 00 00 00 00 00 00 ff ff ff ff b8 5e 46 00 06 53 79 73 74 65 6d b8 5e 46 00 02 00 00 80 09 44 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 09 44 00 00 00 00 00 88 09 44 00 00 00 00 00 96 09 44 00 08 00 00 00 10 17 40 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 b4 57 40 00 b4
                                                                                        Data Ascii: tionTCollectionNotification@@PCD@Sender@ItemPCActionD TArray<System.TypInfo.PTypeInfo>^FSystem^FDDDD@]@]@`@`@,`@0`@4`@(`@\@\@\@W@
                                                                                        2022-07-25 13:17:42 UTC274INData Raw: 8b 4d 08 8b 09 8d 04 c1 e8 fd 43 fc ff 8b c8 8d 45 90 5a e8 c2 8a ff ff 83 6d f8 04 83 45 fc 04 e9 fa 01 00 00 8b 45 fc 8b 00 89 45 90 83 7d 90 00 75 29 8d 85 60 ff ff ff e8 54 83 ff ff 8d 95 60 ff ff ff 8d 04 5b 8b 4d 08 8b 09 8d 04 c1 8b 0d 4c 2d 43 00 e8 7c 46 fc ff eb 50 8d 85 48 ff ff ff 50 8b 04 9e 8b 10 ff 52 10 e8 ae 22 00 00 50 8b 45 90 8b 00 e8 17 28 02 00 8b 00 8d 55 e0 e8 95 84 ff ff 8d 45 e0 b1 01 5a e8 16 87 ff ff 8d 95 48 ff ff ff 8d 04 5b 8b 4d 08 8b 09 8d 04 c1 8b 0d 4c 2d 43 00 e8 2a 46 fc ff 83 6d f8 04 83 45 fc 04 e9 66 01 00 00 8b 45 fc 8b 00 89 45 90 8d 85 30 ff ff ff 50 8b 04 9e 8b 10 ff 52 10 e8 49 22 00 00 50 8b 55 90 a1 e0 17 4c 00 e8 a7 f9 ff ff 8d 55 c8 e8 df 83 ff ff 8d 45 c8 b1 01 5a e8 b0 86 ff ff 8d 95 30 ff ff ff 8d 04 5b
                                                                                        Data Ascii: MCEZmEEE}u)`T`[ML-C|FPHPR"PE(UEZH[ML-C*FmEfEE0PRI"PULUEZ0[
                                                                                        2022-07-25 13:17:42 UTC290INData Raw: e8 91 e8 fb ff 8b 75 0c 46 4e 85 f6 7c 3e 46 33 ff 8b 9d 78 ff ff ff 8b 85 7c ff ff ff 8b 10 ff 52 14 50 8b 85 70 ff ff ff 8d 04 40 8b 55 fc 8d 0c c2 8b 45 f8 8b 04 b8 8b d3 e8 0f 39 ff ff ff 85 70 ff ff ff 47 83 c3 18 4e 75 cb 8b 85 7c ff ff ff 8b 10 ff 52 30 84 c0 74 13 8b 85 7c ff ff ff 8b 10 ff 52 28 89 85 74 ff ff ff eb 65 8b 85 7c ff ff ff 8b 10 ff 52 1c fe c8 74 06 fe c8 74 21 eb 3f 8b 85 7c ff ff ff 8b 10 ff 52 24 0f bf c0 8b 95 6c ff ff ff 8b 04 82 89 85 74 ff ff ff eb 31 8b 85 7c ff ff ff 8b 10 ff 52 24 8b d0 8b 85 6c ff ff ff e8 60 d6 fb ff 89 85 74 ff ff ff eb 11 8b 85 7c ff ff ff 8b 10 ff 52 28 89 85 74 ff ff ff 8b 85 74 ff ff ff e8 44 33 ff ff 8b 85 7c ff ff ff 8b 10 ff 52 30 84 c0 0f 85 3c 01 00 00 8b 85 7c ff ff ff e8 d2 94 00 00 84 c0 0f
                                                                                        Data Ascii: uFN|>F3x|RPp@UE9pGNu|R0t|R(te|Rtt!?|R$lt1|R$l`t|R(ttD3|R0<|
                                                                                        2022-07-25 13:17:42 UTC306INData Raw: 08 00 03 08 3c ce 44 00 00 00 04 53 65 6c 66 02 00 0a 3c 59 43 00 01 00 05 56 61 6c 75 65 02 00 00 b0 d8 40 00 02 00 09 44 69 72 65 63 74 69 6f 6e 02 00 02 00 35 00 18 7c 4b 00 06 44 65 6c 65 74 65 03 00 00 00 00 00 08 00 02 08 3c ce 44 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 05 49 6e 64 65 78 02 00 02 00 4b 00 18 7c 4b 00 0b 44 65 6c 65 74 65 52 61 6e 67 65 03 00 00 00 00 00 08 00 03 08 3c ce 44 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 06 41 49 6e 64 65 78 02 00 00 9c 10 40 00 02 00 06 41 43 6f 75 6e 74 02 00 02 00 4d 00 18 7c 4b 00 0b 45 78 74 72 61 63 74 49 74 65 6d 03 00 3c 59 43 00 08 00 03 08 3c ce 44 00 00 00 04 53 65 6c 66 02 00 0a 3c 59 43 00 01 00 05 56 61 6c 75 65 02 00 00 b0 d8 40 00 02 00 09 44 69 72 65 63 74 69 6f 6e 02
                                                                                        Data Ascii: <DSelf<YCValue@Direction5|KDelete<DSelf@IndexK|KDeleteRange<DSelf@AIndex@ACountM|KExtractItem<YC<DSelf<YCValue@Direction
                                                                                        2022-07-25 13:17:42 UTC322INData Raw: 06 53 65 6e 64 65 72 07 54 4f 62 6a 65 63 74 0a 04 49 74 65 6d 11 54 52 74 74 69 4d 61 6e 61 67 65 64 46 69 65 6c 64 00 06 41 63 74 69 6f 6e 17 54 43 6f 6c 6c 65 63 74 69 6f 6e 4e 6f 74 69 66 69 63 61 74 69 6f 6e 00 88 1f 40 00 84 44 43 00 50 0c 43 00 e0 08 45 00 02 00 00 00 00 00 00 00 03 08 88 1f 40 00 06 53 65 6e 64 65 72 02 00 0a 84 44 43 00 04 49 74 65 6d 02 00 00 50 0c 43 00 06 41 63 74 69 6f 6e 02 00 00 14 09 45 00 0f 2a 49 45 6e 75 6d 65 72 61 62 6c 65 3c 53 79 73 74 65 6d 2e 52 74 74 69 2e 54 52 74 74 69 4d 61 6e 61 67 65 64 46 69 65 6c 64 3e e4 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 00 68 09 45 00 0f 2f 54 4c 69 73 74 3c 53 79 73 74 65 6d 2e 52 74 74 69 2e 54 52 74 74 69 4d 61 6e 61
                                                                                        Data Ascii: SenderTObjectItemTRttiManagedFieldActionTCollectionNotification@DCPCE@SenderDCItemPCActionE*IEnumerable<System.Rtti.TRttiManagedField>&@SystemhE/TList<System.Rtti.TRttiMana
                                                                                        2022-07-25 13:17:42 UTC338INData Raw: 8b 00 c3 8d 40 00 53 56 8b f2 8b d8 3b 73 08 7d 0a 8d 43 04 8b d6 e8 4b da fd ff 8b d6 8d 43 04 e8 1d d9 fd ff 5e 5b c3 8b c0 83 c0 04 e8 34 da fd ff c3 8d 40 00 53 8b 18 ff 53 08 5b c3 83 c4 f8 66 83 78 22 00 0f 95 c2 84 d2 75 17 89 44 24 04 8b 10 8b 52 08 89 14 24 ba a4 49 45 00 3b 14 24 0f 95 c2 84 d2 74 0b ba bc 48 45 00 89 50 14 59 5a c3 33 d2 89 50 14 59 5a c3 8d 40 00 55 8b ec 8b 55 08 89 50 20 8b 55 0c 89 50 24 e8 ac ff ff ff 5d c2 08 00 53 8b 40 1c 8b 18 ff 53 0c 5b c3 90 55 8b ec 6a 00 53 56 8b f2 8b d8 33 c0 55 68 87 49 45 00 64 ff 30 64 89 20 8d 43 1c 8b d6 e8 49 6b fb ff 83 7b 1c 00 75 18 8d 55 fc a1 24 bb 45 00 e8 e6 4c 00 00 8b 55 fc 8d 43 1c e8 2b 6b fb ff b8 1c 49 45 00 89 43 18 33 c0 5a 59 59 64 89 10 68 8e 49 45 00 8d 45 fc e8 f6 6a fb
                                                                                        Data Ascii: @SV;s}CKC^[4@SS[fx"uD$R$IE;$tHEPYZ3PYZ@UUP UP$]S@S[UjSV3UhIEd0d CIk{uU$ELUC+kIEC3ZYYdhIEEj
                                                                                        2022-07-25 13:17:42 UTC354INData Raw: 2c fb ff 85 f6 74 0a b8 38 88 45 00 89 43 18 eb 05 33 c0 89 43 18 33 c0 5a 59 59 64 89 10 68 b9 88 45 00 8d 45 fc e8 cb 2b fb ff c3 e9 85 e7 fa ff eb f0 5e 5b 59 5d c3 8b c0 8b c8 b2 01 a1 40 c0 44 00 e8 be 01 00 00 c3 90 53 66 83 78 22 00 74 0d 51 8b d8 8b ca 8b d0 8b 43 24 ff 53 20 5b c3 90 53 56 84 d2 74 08 83 c4 f0 e8 ba d9 fa ff 8b da 8b f0 33 c9 33 d2 8b c6 e8 1b 00 00 00 8b c6 84 db 74 0f e8 f8 d9 fa ff 64 8f 05 00 00 00 00 83 c4 0c 8b c6 5e 5b c3 90 53 56 57 84 d2 74 08 83 c4 f0 e8 81 d9 fa ff 8b f1 8b da 8b f8 33 d2 8b c7 e8 7a d3 fa ff a1 14 be 44 00 89 47 0c 89 7f 10 8b c7 e8 90 fe ff ff 8b d6 8b c7 e8 ef fe ff ff 8b c7 84 db 74 0f e8 a4 d9 fa ff 64 8f 05 00 00 00 00 83 c4 0c 8b c7 5f 5e 5b c3 53 56 e8 dd d9 fa ff 8b da 8b f0 83 7e 08 00 7e 0a
                                                                                        Data Ascii: ,t8EC3C3ZYYdhEE+^[Y]@DSfx"tQC$S [SVt33td^[SVWt3zDGtd_^[SV~~
                                                                                        2022-07-25 13:17:42 UTC370INData Raw: 49 6e 64 65 78 02 00 0a c4 9a 43 00 02 00 0a 43 6f 6c 6c 65 63 74 69 6f 6e 02 00 02 00 24 00 18 7c 4b 00 04 50 61 63 6b 03 00 00 00 00 00 08 00 01 08 1c cf 45 00 00 00 04 53 65 6c 66 02 00 02 00 35 00 18 7c 4b 00 04 50 61 63 6b 03 00 00 00 00 00 08 00 02 08 1c cf 45 00 00 00 04 53 65 6c 66 02 00 0a b0 bf 45 00 01 00 07 49 73 45 6d 70 74 79 02 00 02 00 35 00 18 7c 4b 00 06 52 65 6d 6f 76 65 03 00 9c 10 40 00 08 00 02 08 1c cf 45 00 00 00 04 53 65 6c 66 02 00 12 ac 96 43 00 01 00 05 56 61 6c 75 65 02 00 02 00 4c 00 18 7c 4b 00 0a 52 65 6d 6f 76 65 49 74 65 6d 03 00 9c 10 40 00 08 00 03 08 1c cf 45 00 00 00 04 53 65 6c 66 02 00 12 ac 96 43 00 01 00 05 56 61 6c 75 65 02 00 00 b0 d8 40 00 02 00 09 44 69 72 65 63 74 69 6f 6e 02 00 02 00 35 00 18 7c 4b 00 06 44
                                                                                        Data Ascii: IndexCCollection$|KPackESelf5|KPackESelfEIsEmpty5|KRemove@ESelfCValueL|KRemoveItem@ESelfCValue@Direction5|KD
                                                                                        2022-07-25 13:17:42 UTC386INData Raw: 45 00 20 ac 45 00 f4 aa 45 00 d8 ab 45 00 0e 00 00 00 00 00 01 00 00 00 3c 05 46 00 1c 00 00 00 00 00 00 00 00 00 03 00 00 90 0d 43 00 04 00 00 00 0b 46 4c 69 73 74 48 65 6c 70 65 72 02 00 00 3c 05 46 00 1c 00 00 00 09 46 43 6f 6d 70 61 72 65 72 02 00 00 7c 07 44 00 20 00 00 00 09 46 4f 6e 4e 6f 74 69 66 79 02 00 00 00 2c 00 51 0a 46 00 44 00 f4 ff 77 0a 46 00 44 00 f4 ff b0 0a 46 00 44 00 f4 ff ea 0a 46 00 4d 00 ff ff 11 0b 46 00 4b 00 03 00 51 0b 46 00 43 00 f4 ff 91 0b 46 00 42 00 f4 ff c3 0b 46 00 42 00 f4 ff fb 0b 46 00 42 00 f4 ff 37 0c 46 00 42 00 f4 ff 73 0c 46 00 42 00 f4 ff b7 0c 46 00 42 00 f4 ff 10 0d 46 00 42 00 f4 ff 5a 0d 46 00 42 00 f4 ff a8 0d 46 00 42 00 f4 ff f6 0d 46 00 42 00 f4 ff 1a 0e 46 00 42 00 f4 ff 4f 0e 46 00 42 00 f4 ff 84 0e
                                                                                        Data Ascii: E EEE<FCFListHelper<FFComparer|D FOnNotify,QFDwFDFDFMFKQFCFBFBFB7FBsFBFBFBZFBFBFBFBOFB
                                                                                        2022-07-25 13:17:42 UTC402INData Raw: 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 54 50 61 69 72 3c 53 79 73 74 65 6d 2e 50 6f 69 6e 74 65 72 2c 53 79 73 74 65 6d 2e 52 74 74 69 2e 54 52 74 74 69 4f 62 6a 65 63 74 3e 3e 32 00 b8 b6 45 00 07 44 65 66 61 75 6c 74 03 00 90 bd 45 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 48 90 bd 45 00 01 00 01 01 02 00 02 00 48 00 18 7c 4b 00 09 43 6f 6e 73 74 72 75 63 74 03 00 90 bd 45 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 0a e4 46 46 00 01 00 0a 43 6f 6d 70 61 72 69 73 6f 6e 02 00 48 90 bd 45 00 02 00 01 01 02 00 02 00 44 00 18 7c 4b 00 07 43 6f 6d 70 61 72 65 03 00 9c 10 40 00 08 00 03 08 64 49 46 00 00 00 04 53 65 6c 66 02 00 12 ac 96 43 00 01 00 04 4c 65 66 74 02 00 12 ac 96 43 00 02 00 05 52 69 67 68 74 02 00 02 00
                                                                                        Data Ascii: nerics.Collections.TPair<System.Pointer,System.Rtti.TRttiObject>>2EDefaultESelfHEH|KConstructESelfFFComparisonHED|KCompare@dIFSelfCLeftCRight
                                                                                        2022-07-25 13:17:42 UTC418INData Raw: 00 00 00 40 1c 46 55 8b ec 83 c4 f4 53 56 8b da 8b f0 8b 03 8b 00 e8 9b e8 ff ff 0f b6 00 83 f8 04 0f 87 a8 00 00 00 ff 24 85 90 88 46 00 a4 88 46 00 be 88 46 00 db 88 46 00 f6 88 46 00 13 89 46 00 db 6d 08 d9 5d fc 9b ff 75 fc 8b cb 8b d6 a1 54 8e 46 00 e8 d8 13 00 00 eb 73 db 6d 08 dd 5d f4 9b ff 75 f8 ff 75 f4 8b cb 8b d6 a1 c0 8f 46 00 e8 b7 14 00 00 eb 56 0f b7 45 10 50 ff 75 0c ff 75 08 8b cb 8b d6 a1 2c 91 46 00 e8 b0 15 00 00 eb 3b db 6d 08 df 7d f4 9b ff 75 f8 ff 75 f4 8b cb 8b d6 a1 9c 92 46 00 e8 af 16 00 00 eb 1e db 6d 08 d8 0d 3c 89 46 00 83 c4 f8 df 3c 24 9b 8b cb 8b d6 a1 04 94 46 00 e8 97 17 00 00 5e 5b 8b e5 5d c2 0c 00 00 00 00 00 40 1c 46 53 56 8b f2 8b d8 8b c3 8b d6 e8 e5 0c fc ff 5e 5b c3 8b c0 56 57 89 d7 8b 57 10 81 fa 00 00 00 80
                                                                                        Data Ascii: @FUSV$FFFFFFm]uTFsm]uuFVEPuu,F;m}uuFm<F<$F^[]@FSV^[VWW
                                                                                        2022-07-25 13:17:42 UTC434INData Raw: 00 04 44 61 74 61 02 00 02 00 40 00 0c c0 48 00 05 45 72 72 6f 72 03 00 00 00 00 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 1c 33 40 00 01 00 03 4d 73 67 02 00 00 54 11 40 00 02 00 04 44 61 74 61 02 00 02 00 48 00 18 7c 4b 00 08 45 78 63 68 61 6e 67 65 03 00 00 00 00 00 08 00 03 08 f8 cc 46 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 06 49 6e 64 65 78 31 02 00 00 9c 10 40 00 02 00 06 49 6e 64 65 78 32 02 00 02 00 26 00 18 7c 4b 00 06 45 78 70 61 6e 64 03 00 f8 cc 46 00 08 00 01 08 f8 cc 46 00 00 00 04 53 65 6c 66 02 00 02 00 35 00 18 7c 4b 00 07 45 78 74 72 61 63 74 03 00 00 11 40 00 08 00 02 08 f8 cc 46 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 04 49 74 65 6d 02 00 02 00 4c 00 18 7c 4b 00 0b 45 78 74 72 61 63 74 49 74 65 6d
                                                                                        Data Ascii: Data@HErrorSelf3@MsgT@DataH|KExchangeFSelf@Index1@Index2&|KExpandFFSelf5|KExtract@FSelf@ItemL|KExtractItem
                                                                                        2022-07-25 13:17:42 UTC450INData Raw: 46 4d 65 6d 6f 72 79 02 00 00 54 11 40 00 08 00 00 00 05 46 53 69 7a 65 02 00 00 54 11 40 00 0c 00 00 00 09 46 50 6f 73 69 74 69 6f 6e 02 00 00 00 05 00 d3 08 47 00 4a 00 03 00 16 09 47 00 4a 00 05 00 69 09 47 00 4a 00 0a 00 ad 09 47 00 4a 00 0b 00 e9 09 47 00 42 00 f4 ff 0c 00 13 54 43 75 73 74 6f 6d 4d 65 6d 6f 72 79 53 74 72 65 61 6d 43 00 c8 d9 48 00 04 52 65 61 64 03 00 9c 10 40 00 08 00 03 08 28 0a 47 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 06 42 75 66 66 65 72 02 00 00 9c 10 40 00 02 00 05 43 6f 75 6e 74 02 00 02 00 53 00 14 da 48 00 04 52 65 61 64 03 00 9c 10 40 00 0c 00 04 08 28 0a 47 00 00 00 04 53 65 6c 66 02 00 00 a4 31 40 00 01 00 06 42 75 66 66 65 72 02 00 00 9c 10 40 00 02 00 06 4f 66 66 73 65 74 02 00 00 9c 10 40 00 08 00 05 43
                                                                                        Data Ascii: FMemoryT@FSizeT@FPositionGJGJiGJGJGBTCustomMemoryStreamCHRead@(GSelfBuffer@CountSHRead@(GSelf1@Buffer@Offset@C
                                                                                        2022-07-25 13:17:42 UTC466INData Raw: 78 40 47 00 08 00 07 41 4d 65 74 68 6f 64 02 00 02 00 3f 00 18 7c 4b 00 0b 53 74 61 74 69 63 51 75 65 75 65 03 00 00 00 00 00 10 00 02 0a fc 4b 47 00 00 00 07 41 54 68 72 65 61 64 02 00 00 78 40 47 00 08 00 07 41 4d 65 74 68 6f 64 02 00 02 00 3f 00 00 78 49 00 0b 53 79 6e 63 68 72 6f 6e 69 7a 65 03 00 00 00 00 00 10 00 02 0a fc 4b 47 00 00 00 07 41 54 68 72 65 61 64 02 00 00 78 40 47 00 08 00 07 41 4d 65 74 68 6f 64 02 00 02 00 43 00 18 7c 4b 00 0b 53 79 6e 63 68 72 6f 6e 69 7a 65 03 00 00 00 00 00 08 00 02 0a fc 4b 47 00 00 00 07 41 54 68 72 65 61 64 02 00 08 9c 40 47 00 01 00 0b 41 54 68 72 65 61 64 50 72 6f 63 02 00 02 00 45 00 18 7c 4b 00 11 53 74 61 74 69 63 53 79 6e 63 68 72 6f 6e 69 7a 65 03 00 00 00 00 00 10 00 02 0a fc 4b 47 00 00 00 07 41 54 68
                                                                                        Data Ascii: x@GAMethod?|KStaticQueueKGAThreadx@GAMethod?xISynchronizeKGAThreadx@GAMethodC|KSynchronizeKGAThread@GAThreadProcE|KStaticSynchronizeKGATh
                                                                                        2022-07-25 13:17:42 UTC482INData Raw: 65 73 2e 54 43 6f 6c 6c 65 63 74 69 6f 6e 49 74 65 6d 3e 6c 87 47 00 88 1f 40 00 00 00 1b 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 00 00 00 00 02 00 00 00 00 a8 88 47 00 11 2e 54 4c 69 73 74 3c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 43 6f 6c 6c 65 63 74 69 6f 6e 49 74 65 6d 3e 2e 61 72 72 61 79 6f 66 54 04 00 00 00 00 00 00 00 ff ff ff ff 00 da 46 00 1b 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 00 da 46 00 02 00 00 00 10 89 47 00 0f 29 49 43 6f 6d 70 61 72 65 72 3c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 43 6f 6c 6c 65 63 74 69 6f 6e 49 74 65 6d 3e b0 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e
                                                                                        Data Ascii: es.TCollectionItem>lG@System.Generics.CollectionsG.TList<System.Classes.TCollectionItem>.arrayofTFSystem.Generics.CollectionsFG)IComparer<System.Classes.TCollectionItem>&@System.Generics.
                                                                                        2022-07-25 13:17:42 UTC498INData Raw: 69 6f 6e 73 5c c7 47 00 02 00 70 c8 47 00 0f 21 49 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 3c 53 79 73 74 65 6d 2e 49 6e 74 65 67 65 72 3e b0 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 44 65 66 61 75 6c 74 73 02 00 ff ff 02 00 00 cc c8 47 00 08 26 54 43 6f 6c 6c 65 63 74 69 6f 6e 4e 6f 74 69 66 79 45 76 65 6e 74 3c 53 79 73 74 65 6d 2e 49 6e 74 65 67 65 72 3e 00 03 08 06 53 65 6e 64 65 72 07 54 4f 62 6a 65 63 74 02 04 49 74 65 6d 07 49 6e 74 65 67 65 72 00 06 41 63 74 69 6f 6e 17 54 43 6f 6c 6c 65 63 74 69 6f 6e 4e 6f 74 69 66 69 63 61 74 69 6f 6e 00 88 1f 40 00 9c 10 40 00 50 0c 43 00 47 c9 47 00 02 00 00 00 00 00 00 00 03 08 88 1f 40 00 06 53 65 6e 64 65 72 02 00 02 9c 10 40 00
                                                                                        Data Ascii: ions\GpG!IEqualityComparer<System.Integer>&@System.Generics.DefaultsG&TCollectionNotifyEvent<System.Integer>SenderTObjectItemIntegerActionTCollectionNotification@@PCGG@Sender@
                                                                                        2022-07-25 13:17:42 UTC514INData Raw: 00 49 54 44 69 63 74 69 6f 6e 61 72 79 3c 53 79 73 74 65 6d 2e 73 74 72 69 6e 67 2c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 50 65 72 73 69 73 74 65 6e 74 43 6c 61 73 73 3e 2e 54 4b 65 79 45 6e 75 6d 65 72 61 74 6f 72 3b 00 88 d1 49 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 02 08 10 09 48 00 00 00 04 53 65 6c 66 02 00 0a 04 1c 48 00 02 00 0b 41 44 69 63 74 69 6f 6e 61 72 79 02 00 02 00 28 00 cc d1 49 00 08 4d 6f 76 65 4e 65 78 74 03 00 00 10 40 00 08 00 01 08 10 09 48 00 00 00 04 53 65 6c 66 02 00 02 00 14 09 48 00 07 49 54 44 69 63 74 69 6f 6e 61 72 79 3c 53 79 73 74 65 6d 2e 73 74 72 69 6e 67 2c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 50 65 72 73 69 73 74 65 6e 74 43 6c 61 73 73 3e 2e 54 4b 65 79 45 6e 75 6d 65 72 61 74 6f 72 14 08
                                                                                        Data Ascii: ITDictionary<System.string,System.Classes.TPersistentClass>.TKeyEnumerator;ICreateHSelfHADictionary(IMoveNext@HSelfHITDictionary<System.string,System.Classes.TPersistentClass>.TKeyEnumerator
                                                                                        2022-07-25 13:17:42 UTC530INData Raw: f4 8b 40 04 85 c0 74 05 e8 e9 86 01 00 8b 45 f4 8b 40 08 85 c0 74 05 e8 da 86 01 00 33 c0 5a 59 59 64 89 10 68 a1 48 48 00 8d 45 f8 8b 15 08 01 48 00 e8 f7 43 f8 ff c3 e9 9d 27 f8 ff eb ea 5f 5e 5b 8b e5 5d c3 55 8b ec 83 c4 f8 53 56 84 d2 74 08 83 c4 f0 e8 f4 19 f8 ff 88 55 ff 8b d8 33 d2 8b c3 e8 ee 13 f8 ff b1 01 b2 01 a1 bc 42 48 00 e8 20 94 01 00 89 43 04 8b 0d c8 d6 46 00 b2 01 a1 cc f7 47 00 e8 2f fc ff ff 8b f0 8b 43 04 89 75 f8 8d 55 f8 83 c0 04 e8 dc ca fa ff c6 46 10 01 8b c3 80 7d ff 00 74 0f e8 f7 19 f8 ff 64 8f 05 00 00 00 00 83 c4 0c 8b c3 5e 5b 59 59 5d c3 90 53 56 e8 2d 1a f8 ff 8b da 8b f0 8b 46 04 e8 b1 13 f8 ff b2 fc 22 d3 8b c6 e8 96 13 f8 ff 84 db 7e 07 8b c6 e8 b3 19 f8 ff 5e 5b c3 53 56 57 55 83 c4 f8 89 14 24 8b e8 33 c0 89 44 24
                                                                                        Data Ascii: @tE@t3ZYYdhHHEHC'_^[]USVtU3BH CFG/CuUF}td^[YY]SV-F"~^[SVWU$3D$
                                                                                        2022-07-25 13:17:42 UTC546INData Raw: 73 74 65 6d 2e 54 43 6c 61 73 73 2c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 46 69 65 6c 64 73 43 61 63 68 65 2e 54 46 69 65 6c 64 73 3e 3e 1c 87 48 00 88 1f 40 00 00 00 1b 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 00 00 00 00 02 00 00 00 00 00 00 c8 88 48 00 0e 44 54 44 69 63 74 69 6f 6e 61 72 79 3c 53 79 73 74 65 6d 2e 54 43 6c 61 73 73 2c 53 79 73 74 65 6d 2e 43 6c 61 73 73 65 73 2e 54 46 69 65 6c 64 73 43 61 63 68 65 2e 54 46 69 65 6c 64 73 3e 2e 54 49 74 65 6d 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 10 40 00 00 00 00 00 02 08 48 61 73 68 43 6f 64 65 02 00 14 13 40 00 04 00 00 00 02 03 4b 65 79 02 00 28 67 48 00 08 00 00 00 02 05 56 61 6c 75 65 02 00 02 00 00 00 00 58 89 48 00 11 49 54 44 69 63 74 69 6f
                                                                                        Data Ascii: stem.TClass,System.Classes.TFieldsCache.TFields>>H@System.Generics.CollectionsHDTDictionary<System.TClass,System.Classes.TFieldsCache.TFields>.TItem@HashCode@Key(gHValueXHITDictio
                                                                                        2022-07-25 13:17:42 UTC562INData Raw: e5 5d c3 8d 40 00 55 8b ec 51 53 56 8b f2 89 45 fc 8b 45 fc 8b 40 0c e8 d6 db 00 00 8b d8 33 d2 55 68 c3 c8 48 00 64 ff 32 64 89 22 3b 73 08 7d 0a 8d 43 04 8b d6 e8 0b 5a fa ff 8b d6 8d 43 04 e8 21 59 fa ff 33 c0 5a 59 59 64 89 10 68 ca c8 48 00 8b 45 fc 8b 40 0c 8b 40 08 e8 a6 9f f7 ff c3 e9 74 a7 f7 ff eb ea 5e 5b 59 5d c3 90 55 8b ec 51 53 8b da 89 45 fc 8b 45 fc 8b 40 0c e8 6f db 00 00 33 d2 55 68 19 c9 48 00 64 ff 32 64 89 22 83 c0 04 8b d3 e8 ab 59 fa ff 33 c0 5a 59 59 64 89 10 68 20 c9 48 00 8b 45 fc 8b 40 0c 8b 40 08 e8 50 9f f7 ff c3 e9 1e a7 f7 ff eb ea 5b 59 5d c3 55 8b ec 83 c4 f8 53 56 8b f1 8b da 89 45 fc 8b 45 fc 8b 40 0c e8 16 db 00 00 33 d2 55 68 7a c9 48 00 64 ff 32 64 89 22 83 c0 04 89 45 f8 8b 45 f8 8b ce 8b d3 e8 16 47 fa ff 33 c0 5a
                                                                                        Data Ascii: ]@UQSVEE@3UhHd2d";s}CZC!Y3ZYYdhHE@@t^[Y]UQSEE@o3UhHd2d"Y3ZYYdh HE@@P[Y]USVEE@3UhzHd2d"EEG3Z
                                                                                        2022-07-25 13:17:42 UTC578INData Raw: ff 8b 18 ff 53 3c 33 c0 5a 59 59 64 89 10 eb 17 e9 11 65 f7 ff 8b 45 08 33 d2 89 50 f8 e8 08 69 f7 ff e8 57 69 f7 ff 8b 45 08 8b 40 f8 66 83 48 1c 01 33 c0 5a 59 59 64 89 10 eb 23 e9 e5 64 f7 ff 8b 45 08 50 8b 45 08 83 c0 f8 e8 a6 fe ff ff 59 84 c0 75 05 e8 d0 68 f7 ff e8 1f 69 f7 ff 5f 5e 5b 5d c3 8b c0 55 8b ec 53 56 57 33 c0 55 68 40 09 49 00 64 ff 30 64 89 20 8b 45 08 8b 40 f0 8b 50 2c 8b 45 08 8b 40 f8 66 be f7 ff e8 dc 56 f7 ff 8b 45 08 8d 48 f4 8b 45 08 8b 50 f8 8b 45 08 8b 40 f0 8b 18 ff 53 20 8b 45 08 8b 40 f8 f6 40 1c 10 74 1f 8b 45 08 8b 40 f4 e8 b6 5c ff ff 8b 55 08 3b 42 f8 75 0c 8b 45 08 8b 40 f8 66 81 48 1c 00 02 33 c0 5a 59 59 64 89 10 eb 23 e9 43 64 f7 ff 8b 45 08 50 8b 45 08 83 c0 f8 e8 04 fe ff ff 59 84 c0 75 05 e8 2e 68 f7 ff e8 7d 68
                                                                                        Data Ascii: S<3ZYYdeE3PiWiE@fH3ZYYd#dEPEYuhi_^[]USVW3Uh@Id0d E@P,E@fVEHEPE@S E@@tE@\U;BuE@fH3ZYYd#CdEPEYu.h}h
                                                                                        2022-07-25 13:17:42 UTC594INData Raw: 3a 8b 43 04 ff 70 08 68 e4 48 49 00 ff 73 08 8b c6 ba 03 00 00 00 e8 47 3f f7 ff eb 1e 83 7b 08 00 74 11 8b 53 08 8b c6 b9 f4 48 49 00 e8 a8 3e f7 ff eb 07 8b c6 e8 83 31 f7 ff 33 c0 5a 59 59 64 89 10 68 ba 48 49 00 8d 45 fc e8 6e 31 f7 ff c3 e9 84 27 f7 ff eb f0 5f 5e 5b 59 5d c3 b0 04 02 00 ff ff ff ff 05 00 00 00 4f 00 77 00 6e 00 65 00 72 00 00 00 b0 04 02 00 ff ff ff ff 01 00 00 00 2e 00 00 00 b0 04 02 00 ff ff ff ff 06 00 00 00 2e 00 4f 00 77 00 6e 00 65 00 72 00 00 00 00 00 55 8b ec 83 c4 e8 33 c0 89 45 e8 89 45 fc 89 45 f8 33 c0 55 68 0f 4b 49 00 64 ff 30 64 89 20 8b 45 08 8b 50 f8 8b 45 08 8b 40 f0 e8 b0 36 fd ff 89 45 f4 83 7d f4 00 75 1c 8b 45 08 50 e8 8a fa ff ff 59 8b 45 08 8b 40 fc b2 0d e8 60 0b 00 00 e9 93 01 00 00 8b 45 f4 8b 15 c8 d6 46
                                                                                        Data Ascii: :CphHIsG?{tSHI>13ZYYdhHIEn1'_^[Y]Owner..OwnerU3EEE3UhKId0d EPE@6E}uEPYE@`EF
                                                                                        2022-07-25 13:17:42 UTC610INData Raw: c7 04 24 00 00 00 00 8b 73 10 8b 46 08 3b 04 24 77 05 e8 4f 86 f9 ff 8b 43 34 8b 56 04 8b 0c 24 8b 14 8a 89 54 24 04 8d 54 24 04 83 c0 04 8b 0c 24 e8 dc 86 f9 ff ff 04 24 4f 75 cb 8b 43 34 8b 15 04 1c 4c 00 e8 88 2b 00 00 8b cc 8b d5 8b c3 e8 0d 00 00 00 8b f0 8b c6 59 5a 5d 5f 5e 5b c3 8b c0 53 56 57 55 83 c4 ec 89 4c 24 08 89 54 24 04 89 04 24 33 f6 8b 04 24 8b 40 34 8b 78 08 4f 3b fe 7c 4b 8d 1c 37 d1 eb 8b 04 24 8b 40 34 89 44 24 10 8b 44 24 10 8b 40 04 8b 04 98 89 44 24 0c 8b 44 24 0c 8b 40 08 8b 54 24 04 e8 55 0e f8 ff 8b e8 85 ed 7d 05 8d 73 01 eb 0f 8b fb 4f 85 ed 75 08 8b 44 24 08 89 18 eb 10 3b fe 7d b5 8b 44 24 08 89 30 33 c0 89 44 24 0c 8b 44 24 0c 83 c4 14 5d 5f 5e 5b c3 8d 40 00 53 56 83 c4 f8 8b f2 8b d8 8b cc 8b 56 08 8b c3 e8 63 ff ff ff
                                                                                        Data Ascii: $sF;$wOC4V$T$T$$$OuC4L+YZ]_^[SVWUL$T$$3$@4xO;|K7$@4D$D$@D$D$@T$U}sOuD$;}D$03D$D$]_^[@SVVc
                                                                                        2022-07-25 13:17:42 UTC626INData Raw: 24 83 c0 04 e8 c5 5a f9 ff 5a c3 8d 40 00 8b 50 04 8b 40 08 8b 52 04 8b 04 82 c3 8d 40 00 8b 50 04 8b 40 08 8b 52 04 8b 04 82 c3 8d 40 00 ff 40 08 8b 50 08 8b 40 04 3b 50 08 0f 9c c0 c3 53 56 57 84 d2 74 08 83 c4 f0 e8 01 9a f6 ff 8b f1 8b da 8b f8 33 d2 8b c7 e8 fa 93 f6 ff 89 77 04 c7 47 08 ff ff ff ff 8b c7 84 db 74 0f e8 35 9a f6 ff 64 8f 05 00 00 00 00 83 c4 0c 8b c7 5f 5e 5b c3 90 55 8b ec 83 c4 f0 53 56 89 4d f4 8b f2 8b d8 8d 45 f8 8b 15 08 01 48 00 e8 b3 c2 f6 ff 33 c0 55 68 b1 c9 49 00 64 ff 30 64 89 20 56 8b 45 f4 b9 01 00 00 00 8b 15 bc 01 48 00 e8 dd d2 f6 ff 83 c4 04 33 f6 8b c3 8b 10 ff 12 89 45 f0 33 c0 55 68 8e c9 49 00 64 ff 30 64 89 20 eb 21 8d 55 f8 8b 45 f0 8b 08 ff 11 8b 45 f4 8b 00 8d 04 f0 8d 55 f8 8b 0d 08 01 48 00 e8 fb c5 f6 ff
                                                                                        Data Ascii: $ZZ@P@R@P@R@@P@;PSVWt3wGt5d_^[USVMEH3UhId0d VEH3E3UhId0d !UEEUH
                                                                                        2022-07-25 13:17:42 UTC642INData Raw: 08 e8 80 54 f6 ff c3 e9 ce 67 f6 ff eb e2 80 7d fb 00 7e 08 8b 45 fc e8 82 5a f6 ff 59 59 5d c3 8b c0 55 8b ec 83 c4 e4 53 33 c9 89 4d e4 8b da 89 45 fc 33 c0 55 68 78 09 4a 00 64 ff 30 64 89 20 8b 45 fc e8 d9 00 00 00 33 d2 55 68 5b 09 4a 00 64 ff 32 64 89 22 8b 45 fc 80 78 0c 01 75 04 b0 01 eb 1e 8b 45 fc 8b 40 04 89 5d f8 83 c0 04 89 45 f4 8d 55 f8 8b 45 f4 e8 94 08 f9 ff 40 0f 94 c0 84 c0 74 16 8b 45 fc 8b 40 04 89 5d f0 8d 55 f0 83 c0 04 e8 e0 0a f9 ff eb 44 8b 45 fc 80 78 0c 02 75 3b 8b 45 fc 8b 40 04 8b d3 e8 c4 02 00 00 89 45 e8 c6 45 ec 00 8d 45 e8 50 6a 00 8d 55 e4 a1 7c a5 4b 00 e8 c2 c0 f6 ff 8b 4d e4 b2 01 a1 a0 56 41 00 e8 63 e9 f7 ff e8 da 67 f6 ff 33 c0 5a 59 59 64 89 10 68 62 09 4a 00 8b 45 fc 8b 40 08 e8 0e 5f f6 ff c3 e9 dc 66 f6 ff eb
                                                                                        Data Ascii: Tg}~EZYY]US3ME3UhxJd0d E3Uh[Jd2d"ExuE@]EUE@tE@]UDExu;E@EEEPjU|KMVAcg3ZYYdhbJE@_f
                                                                                        2022-07-25 13:17:42 UTC658INData Raw: 1c 00 00 00 09 46 43 6f 6d 70 61 72 65 72 02 00 00 c8 c8 47 00 20 00 00 00 09 46 4f 6e 4e 6f 74 69 66 79 02 00 00 00 2c 00 03 4a 4a 00 44 00 f4 ff 29 4a 4a 00 44 00 f4 ff 62 4a 4a 00 44 00 f4 ff 9c 4a 4a 00 4d 00 ff ff c3 4a 4a 00 4b 00 03 00 03 4b 4a 00 43 00 f4 ff 43 4b 4a 00 42 00 f4 ff 75 4b 4a 00 42 00 f4 ff ad 4b 4a 00 42 00 f4 ff e9 4b 4a 00 42 00 f4 ff 25 4c 4a 00 42 00 f4 ff 69 4c 4a 00 42 00 f4 ff c2 4c 4a 00 42 00 f4 ff 0c 4d 4a 00 42 00 f4 ff 5a 4d 4a 00 42 00 f4 ff a8 4d 4a 00 42 00 f4 ff cc 4d 4a 00 42 00 f4 ff 01 4e 4a 00 42 00 f4 ff 36 4e 4a 00 42 00 f4 ff 82 4e 4a 00 42 00 f4 ff b7 4e 4a 00 42 00 f4 ff 02 4f 4a 00 42 00 f4 ff 4f 4f 4a 00 42 00 f4 ff 85 4f 4a 00 42 00 f4 ff bd 4f 4a 00 42 00 f4 ff 05 50 4a 00 42 00 f4 ff 4d 50 4a 00 42 00
                                                                                        Data Ascii: FComparerG FOnNotify,JJD)JJDbJJDJJMJJKKJCCKJBuKJBKJBKJB%LJBiLJBLJBMJBZMJBMJBMJBNJB6NJBNJBNJBOJBOOJBOJBOJBPJBMPJB
                                                                                        2022-07-25 13:17:42 UTC674INData Raw: 74 3c 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 54 50 61 69 72 3c 53 79 73 74 65 6d 2e 73 74 72 69 6e 67 2c 53 79 73 74 65 6d 2e 43 61 72 64 69 6e 61 6c 3e 3e 2e 54 45 6d 70 74 79 46 75 6e 63 b0 26 40 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 53 79 73 74 65 6d 2e 47 65 6e 65 72 69 63 73 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 01 00 ff ff 02 00 00 40 89 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 8a 4a 00 48 89 4a 00 73 89 4a 00 00 00 00 00 89 89 4a 00 10 00 00 00 5c 6a 48 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 90 1e 4a 00 10 1f 4a 00 00 00 00 00 00 00 02 00 00 9c 97 4a 00 04 00 00 00 05 46 4c 69 73 74 02 00
                                                                                        Data Ascii: t<System.Generics.Collections.TPair<System.string,System.Cardinal>>.TEmptyFunc&@@System.Generics.Collections@J@JHJsJJ\jH]@]@`@`@,`@0`@4`@(`@\@\@\@JJJFList
                                                                                        2022-07-25 13:17:42 UTC690INData Raw: 28 67 48 00 01 00 05 56 61 6c 75 65 02 00 02 00 38 00 18 7c 4b 00 09 45 78 74 72 61 63 74 41 74 03 00 28 67 48 00 08 00 02 08 f0 cc 4a 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 05 49 6e 64 65 78 02 00 02 00 48 00 18 7c 4b 00 08 45 78 63 68 61 6e 67 65 03 00 00 00 00 00 08 00 03 08 f0 cc 4a 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 06 49 6e 64 65 78 31 02 00 00 9c 10 40 00 02 00 06 49 6e 64 65 78 32 02 00 02 00 48 00 18 7c 4b 00 04 4d 6f 76 65 03 00 00 00 00 00 08 00 03 08 f0 cc 4a 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 08 43 75 72 49 6e 64 65 78 02 00 00 9c 10 40 00 02 00 08 4e 65 77 49 6e 64 65 78 02 00 02 00 25 00 18 7c 4b 00 05 46 69 72 73 74 03 00 28 67 48 00 08 00 01 08 f0 cc 4a 00 00 00 04 53 65 6c 66 02 00 02 00 24 00
                                                                                        Data Ascii: (gHValue8|KExtractAt(gHJSelf@IndexH|KExchangeJSelf@Index1@Index2H|KMoveJSelf@CurIndex@NewIndex%|KFirst(gHJSelf$
                                                                                        2022-07-25 13:17:42 UTC706INData Raw: 61 00 66 00 74 00 65 00 72 00 20 00 68 00 61 00 76 00 69 00 6e 00 67 00 20 00 63 00 68 00 65 00 63 00 6b 00 65 00 64 00 20 00 74 00 68 00 65 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 6c 00 69 00 6e 00 65 00 2e 00 0d 00 0a 00 2f 00 53 00 41 00 56 00 45 00 49 00 4e 00 46 00 3d 00 22 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 22 00 0d 00 0a 00 49 00 6e 00 73 00 74 00 72 00 75 00 63 00 74 00 73 00 20 00 53 00 65 00 74 00 75 00 70 00 20 00 74 00 6f 00 20 00 73 00 61 00 76 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 20 00 74 00 6f 00 20 00 74 00 68 00 65 00 20 00 73 00 70 00 65 00 63 00 69 00 66 00 69 00 65 00 64 00 20 00 66 00 69 00 6c 00 65
                                                                                        Data Ascii: after having checked the command line./SAVEINF="filename"Instructs Setup to save installation settings to the specified file
                                                                                        2022-07-25 13:17:42 UTC722INData Raw: 00 c7 05 08 b0 4b 00 a0 95 40 00 e8 3e 0b f5 ff e8 55 0b f5 ff 66 c7 05 68 b0 4b 00 b0 d7 66 c7 05 44 b3 4b 00 b0 d7 66 c7 05 20 b6 4b 00 b0 d7 e8 49 e6 f4 ff a3 50 b0 4b 00 e8 6f e7 f4 ff a3 4c b0 4b 00 e8 65 e6 f4 ff a3 7c b9 4b 00 c7 05 80 b9 4b 00 b0 04 00 00 e8 d1 e5 f4 ff a3 44 b0 4b 00 e8 ef 79 f5 ff 33 c0 5a 59 59 64 89 10 68 de 50 4b 00 c3 e9 60 1f f5 ff eb f8 5d c3 83 2d 48 e6 4b 00 01 c3 83 2d 58 e6 4b 00 01 73 0a c7 05 54 e6 4b 00 5c e0 40 00 c3 83 2d 5c e6 4b 00 01 73 0c e8 a6 93 f5 ff 33 c0 a3 60 e6 4b 00 c3 8b c0 55 8b ec b9 07 00 00 00 6a 00 6a 00 49 75 f9 53 56 57 33 c0 55 68 88 53 4b 00 64 ff 30 64 89 20 83 2d 64 e6 4b 00 01 0f 83 2c 02 00 00 68 98 53 4b 00 e8 4d 90 f5 ff 8b f8 e8 56 91 f5 ff 86 e0 33 db 66 3d 00 06 74 1e 68 b4 53 4b 00
                                                                                        Data Ascii: K@>UfhKfDKf KIPKoLKe|KKDKy3ZYYdhPK`]-HK-XKsTK\@-\Ks3`KUjjIuSVW3UhSKd0d -dK,hSKMV3f=thSK
                                                                                        2022-07-25 13:17:42 UTC738INData Raw: 43 00 98 da 43 00 98 da 43 00 d8 f3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 98 da 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 cc e3 43 00 cc e3 43 00 d8 f3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 cc e3 43 00 cc e3 43 00 d8 f3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 cc e3 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 f4 d5 43 00 2c f1 43 00 2c f1 43 00 2c f1 43 00 2c
                                                                                        Data Ascii: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC,C,C,C,
                                                                                        2022-07-25 13:17:42 UTC754INData Raw: b2 c9 5f 63 63 c5 c5 c9 c9 c6 c5 c9 c9 c9 c5 95 63 c5 9b 75 75 75 75 75 75 75 75 75 75 c0 17 13 11 c0 c0 cb 7d 00 00 7d cb c5 c0 10 63 c0 c5 c9 c5 c9 63 63 63 c9 c9 c6 c9 c5 c9 c9 c5 c5 c5 95 95 b7 c5 c5 c5 c5 c5 c5 c5 c5 c5 c5 c5 ab 15 13 10 c0 c0 cb 7d 00 00 7d cb c9 c0 10 85 c5 b2 ae b2 c5 63 85 85 c5 75 74 74 75 74 74 75 75 c5 99 95 95 86 85 95 85 85 85 63 85 5f 4a 33 1f 1d 15 11 c0 c0 cb 7d 00 00 7d cb c5 c0 10 99 c3 c5 c5 c9 c9 86 86 86 b8 c1 c0 c1 c0 c1 c1 c0 c1 b7 99 95 99 95 99 95 95 86 86 99 85 86 85 85 87 85 85 10 c0 c6 cb 7d 00 00 7d cb c9 b9 10 9c c5 b2 ae ae c6 99 99 99 99 9c 9c 9c 9c 9c 9c 9c 9c 9c 9c 9c 99 99 99 99 99 9c 99 99 99 99 99 9c 87 9c 87 12 c0 c0 cb 7d 00 00 7d cb c9 c0 10 9e c5 c9 c5 c9 c5 9c 9e 9c 9e 9c 9e 9c 9e 9c 9e 9e 9e 9c
                                                                                        Data Ascii: _cccuuuuuuuuuu}}cccc}}cuttuttuuc_J3}}}}}}
                                                                                        2022-07-25 13:17:42 UTC770INData Raw: bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff bd bd bd ff b1 b1 b1 ff 42 42 42 ff 42 42 42 ff 43 43 43 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 ff 46 46 46 fd 46 46 46 ee 47 47 47 d9 48 48 48 c2 48 48 48 ab 4a 4a 4a 92 4a 4a 4a 78 4a 4a 4a 5d 4d 4d 4d 40 4e 4e 4e 23 7a 7a 7a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                        Data Ascii: BBBBBBCCCFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFGGGHHHHHHJJJJJJxJJJ]MMM@NNN#zzz
                                                                                        2022-07-25 13:17:42 UTC786INData Raw: 67 ff c4 94 66 ff c3 93 65 ff c2 92 64 ff c1 91 63 ff c0 90 62 ff bf 8f 61 ff bf 8e 60 ff be 8d 5f ff bd 8c 5e ff bc 8b 5d ff bb 8a 5c ff ba 89 5b ff b9 88 5a ff b8 87 59 ff b7 86 58 ff b6 85 57 ff b5 84 56 ff b4 83 55 ff b3 82 54 ff b2 81 53 ff b1 80 52 ff b0 7f 51 ff b0 7e 50 ff af 7d 4f ff ae 7c 4e ff ad 7b 4d ff ac 7a 4c ff ab 79 4b ff aa 78 4a ff a9 77 49 ff a8 76 48 ff a7 75 47 ff a6 74 46 ff a5 73 45 ff a4 72 44 ff a3 71 43 ff a2 70 42 ff a1 6f 41 ff 9f 6c 3e ff 86 49 1f ff 86 49 1f ff ab 86 6c ff e4 e7 e7 ff e4 e7 e7 ff e4 e7 e7 ff e4 e7 e7 ff e6 e9 e9 ff ff ff ff ff ff ff ff ff da db db ff 84 89 87 ff 84 89 87 ff 96 9a 99 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 96 94 69 84 89 87 ff 84 89 87 ff e5 e6 e6 ff ff ff ff ff ff ff ff ff e9
                                                                                        Data Ascii: gfedcba`_^]\[ZYXWVUTSRQ~P}O|N{MzLyKxJwIvHuGtFsErDqCpBoAl>IIlRi
                                                                                        2022-07-25 13:17:42 UTC802INData Raw: cf ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff ec ee ee ff b6 98 7c ff 93 60 31 ff 93 60 31 ff 93 60 31 ff 93 60 31 ff 92 5e 30 ff 86 49 1f ff 86 49 1f ff ab 87 6d ff e6 e9 e9 ff e6 e9 e9 ff e6 e9 e9 ff e6 e9 e9 ff e8 ea ea ff ff ff ff ff ff ff ff ff d9 da da ff 84 89 87 ff 84 89 87 ff 96 9a 98 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 95 93 64 84 89 87 ff 84 89 87 ff e0 e2 e1 ff ff ff ff ff ff ff ff ff ec
                                                                                        Data Ascii: |`1`1`1`1^0IImNd
                                                                                        2022-07-25 13:17:42 UTC818INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff d2 d4 d3 ff 86 8b 89 ff 84 89 87 ff 84 89 87 fd 8b 90 8e 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8a 8f 8d 61 84 89 87 fc 84 89 87 ff 84
                                                                                        Data Ascii: Ia
                                                                                        2022-07-25 13:17:42 UTC834INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 c0 00 00 00 00 03 00 00 f0 00 00 00 00 0f 00 00 ff ff ff ff ff ff 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 80 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                        Data Ascii: ( @
                                                                                        2022-07-25 13:17:42 UTC850INData Raw: 41 72 63 68 69 74 65 63 74 75 72 65 3d 22 78 38 36 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 75 62 6c 69 63 4b 65 79 54 6f 6b 65 6e 3d 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 61 6e 67 75 61 67 65 3d 22 2a 22 0d 0a 20 20 20 20 20 20 20 20 2f 3e 0d 0a 20 20 20 20 3c 2f 64 65 70 65 6e 64 65 6e 74 41 73 73 65 6d 62 6c 79 3e 0d 0a 3c 2f 64 65 70 65 6e 64 65 6e 63 79 3e 0d 0a 3c 74 72 75 73 74 49 6e 66 6f 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 33 22 3e 0d 0a 20 20 20 20 3c 73 65 63 75 72 69 74 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 72 65 71 75 65 73 74 65 64 50 72 69 76 69 6c 65 67 65 73 3e 0d 0a 20 20 20 20 20 20 20 20
                                                                                        Data Ascii: Architecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges>
                                                                                        2022-07-25 13:17:42 UTC866INData Raw: a2 33 cf 92 8e 41 0c e5 ab 6b 86 26 c0 76 83 d6 d0 01 ab 6e 7c f2 48 b3 07 98 de 4d aa 80 e0 08 7b 6f 70 b6 5c 1a 24 5d 62 de 26 fa f2 48 c0 35 73 da b7 95 37 a8 1a dc 4e 4a 1a c6 c1 49 8c 9b 7f 81 bc 78 ef fc c1 5f e0 e6 d1 24 8a 6c 51 2e 98 75 cd db 2f 0b 27 2b 65 57 f0 47 7c 12 41 fe a1 af 0d c2 ce c2 5d a7 40 52 4a ab a8 8d c4 ab 45 7a 89 2c e2 14 73 26 77 3f 4d d8 50 25 0e f9 90 b7 e9 bc ce 29 f3 64 63 29 2c 22 72 61 76 95 96 72 66 19 4f df 99 06 35 8a 5b 4d dc b6 0d dc 01 d7 82 91 e2 9d a1 9f 5c 5f fa 9b e4 1d 83 15 68 33 48 8a 6a 7c 7f 6d e3 02 2e 27 21 f5 b5 fb c6 f9 83 ba fe ad ec c3 b2 48 87 46 98 b4 eb b0 0a de 62 d6 5c 32 8f de 7a 41 ab 0b 83 40 85 ef 23 3a 45 71 79 92 06 f9 de 2a e4 a0 39 4b 28 89 9e 44 6a c0 d1 2a eb f1 21 f3 a1 64 9f 03 63
                                                                                        Data Ascii: 3Ak&vn|HM{op\$]b&H5s7NJIx_$lQ.u/'+eWG|A]@RJEz,s&w?MP%)dc),"ravrfO5[M\_h3Hj|m.'!HFb\2zA@#:Eqy*9K(Dj*!dc
                                                                                        2022-07-25 13:17:42 UTC882INData Raw: 2e c3 34 48 49 b4 6f 81 21 2f 21 84 b2 9f ae 93 cb bc f1 6c 60 9a f6 2b 5b 91 8e 97 a1 01 9a 3e 55 9c 1b 39 08 22 5c 37 7f 2b 61 4b b6 a9 88 2d 05 ea 09 72 29 e1 7f 51 f9 cc 9e 7f 19 0e b7 f9 ae bb 21 5c b1 be 35 be 80 ba 53 af a3 f9 ec 16 e5 2e c6 96 84 c5 24 65 82 e6 19 79 4b 2d e8 5c f3 69 4b 39 61 1a 89 fb c5 01 29 80 f9 9e b0 91 1d 36 6e a1 57 37 1e 4e 0d b7 c4 c6 c6 ef 1a 98 15 a7 61 33 93 6a d1 6f 36 3c a6 98 fe 96 f8 4f 8b 2b b2 74 9b e2 95 51 c2 0b 01 74 79 77 9e 92 d3 48 27 c2 d6 c4 65 6d 7b 59 9d 97 71 7a 31 4f 0a 23 0d 5f 77 a3 a6 38 79 9d 1b ee 01 73 c0 b1 8a 4c c2 d0 f0 7b e6 4d 4d 25 01 fb b9 06 36 f2 08 7f e0 85 f9 ca 99 52 bc 06 78 2f 63 fa cc 1d 3d cd 83 60 52 f1 93 66 0c 9b d1 5c ad 3e 38 db 47 b8 74 0c 3f 57 50 da 38 9c 84 82 b7 b8 8e
                                                                                        Data Ascii: .4HIo!/!l`+[>U9"\7+aK-r)Q!\5S.$eyK-\iK9a)6nW7Na3jo6<O+tQtywH'em{Yqz1O#_w8ysL{MM%6Rx/c=`Rf\>8Gt?WP8
                                                                                        2022-07-25 13:17:42 UTC898INData Raw: 46 e2 61 ce 1d 3b 48 d5 27 12 1e 79 62 12 04 3e 46 d1 af a7 97 69 79 02 90 42 74 97 d9 f4 3c 0e 7b 69 9d 12 0c 28 7f e8 55 85 6b 68 bf eb 4a 6d f9 00 4d b3 b1 ac 25 e5 1c b9 55 6c 61 fc 12 8b 7c cc 53 e7 ca 1d e8 92 07 fd aa b7 6a 86 58 20 c2 e7 5c 48 24 ed 8c 85 58 a8 ce 8b d3 55 e5 83 5b 15 0f a8 95 3d 17 57 2d 16 70 b8 a3 0d 29 85 c5 f5 71 2a 70 c1 ff 4d f7 ea 3d 70 8b 9c 98 10 82 c0 eb 9b e2 a5 08 de f8 29 d9 28 ba 9a 4c 18 5e c4 73 53 c1 87 5e 60 1f 88 e0 8a 96 da 9c 0c b4 c6 f7 96 96 ec f1 21 36 01 be 15 35 3e a4 b1 7a a6 f0 ba 2c 40 2b 5a 11 4a 92 66 b9 87 3d e2 3c 5c 93 39 32 ef 6f c9 f8 93 72 b3 0c 70 28 8e 22 1e 9e cc 30 9a e0 54 b4 36 43 96 e9 14 e9 05 43 d6 8a 13 00 ad 45 49 bd 1c b7 13 88 49 8c ef 67 ce a7 5f f1 25 4d 91 43 cf 0a 55 38 0e ed
                                                                                        Data Ascii: Fa;H'yb>FiyBt<{i(UkhJmM%Ula|SjX \H$XU[=W-p)q*pM=p)(L^sS^`!65>z,@+ZJf=<\92orp("0T6CCEIIg_%MCU8
                                                                                        2022-07-25 13:17:42 UTC914INData Raw: 38 67 ae 55 a7 47 c1 e2 85 f4 37 7c 2f 0a e1 9f 4c b6 74 ff 83 15 74 9b c0 e0 9f f8 77 50 05 67 14 04 68 ef 4d 45 f8 99 ff 6a cb 85 25 c1 bf 35 fc b4 0d a2 48 7e c1 7f 14 9a 53 f0 a2 92 f8 8a b2 e0 f5 03 f7 60 47 1a 79 9e 5a 5e cb 77 76 01 33 44 7d 69 3d 3c bd cc a0 be 1c ca d8 35 5d 44 20 5d 9d 31 37 52 48 6c 32 61 ae fa ca 7f 11 f3 c4 12 8d f7 29 a3 82 a4 c0 8d c9 07 94 bc b3 a1 4e a9 7b d2 e8 00 66 81 93 39 ee 35 26 b5 3e 10 0a 16 17 46 cf 76 53 92 90 95 f8 b9 09 3a 2c 30 83 0b 07 77 91 39 62 4c 6d 45 fb e5 64 d5 29 b7 9b 30 c3 32 9e 05 fa ed 24 21 b4 99 d6 6f 2b ee 2d a1 fa f9 73 ee 57 37 37 88 9f af 26 76 a0 86 53 07 1f 6a 2e 97 42 c8 1a d3 96 ba 3b b6 68 9a fe c1 e9 b6 22 77 d8 9f 7e 27 3c ef 3f 74 f0 76 d6 b0 8d 7b bd 8d 1f 84 e0 d3 40 f1 cb 78 c8
                                                                                        Data Ascii: 8gUG7|/LttwPghMEj%5H~S`GyZ^wv3D}i=<5]D ]17RHl2a)N{f95&>FvS:,0w9bLmEd)02$!o+-sW77&vSj.B;h"w~'<?tv{@x
                                                                                        2022-07-25 13:17:42 UTC930INData Raw: d9 e5 7d 26 00 8a 60 7f 7e 59 d4 ce bd 99 43 eb ef f8 fa b5 97 03 c6 ae d9 14 5a 3f 39 dc 92 42 f5 77 92 a3 1e f9 d4 d9 13 f6 d5 9c 6a 6e 42 01 dc 47 52 d0 94 9b 5f d1 bd e0 80 75 27 29 67 b7 8c c3 d5 64 75 2a 02 b0 08 8a 41 ec 88 83 7c 4d 99 85 1b c9 86 e0 f8 9e b2 40 d7 8e 2e d4 6d 8e d1 36 c8 41 34 d2 2e 3e 8e a1 f1 cb a4 cc fb 02 3d 5c 82 09 ec 9f f7 2f c5 71 9d 6b 31 cf 3c f1 4c 89 7f 9b 0f a3 4f e0 57 02 eb 83 44 72 03 17 ac 71 a4 37 33 5e cc 77 c3 0c ad d0 69 d3 c1 ae 5a 62 65 23 ba d1 c8 9d 55 61 a4 e6 3e 76 95 65 96 f9 04 93 68 e6 7a 5d bb db 19 a1 f0 17 7f 94 27 0b 8e 9b d6 af 32 01 31 a0 b8 28 ee 35 cc e1 d3 7e 9c 2d 5b 91 08 b5 e3 1b c0 7b 5c e0 31 40 19 80 88 02 50 6f 1c f0 8e 81 8c 8d ad c1 2f 49 83 67 96 9f 23 9c c2 83 e2 28 b5 23 3e 46 70
                                                                                        Data Ascii: }&`~YCZ?9BwjnBGR_u')gdu*A|M@.m6A4.>=\/qk1<LOWDrq73^wiZbe#Ua>vehz]'21(5~-[{\1@Po/Ig#(#>Fp
                                                                                        2022-07-25 13:17:42 UTC946INData Raw: fe a3 29 d8 63 30 8f 25 9e 33 41 3b 2f 9b 43 fa 0a 3b 46 b3 84 2c 1a 9a 59 91 fb ce 35 db 09 17 98 ce ac 2e a8 c0 b8 24 fe ae d4 c0 c5 c2 06 68 b5 b5 19 bd fe 00 64 c5 c9 16 8c ee 19 b2 f6 b7 e9 26 10 48 77 5a ed d9 94 99 1a 6f eb f2 ee 98 b3 b4 a6 c3 8f dc 6e 7c 6a 5a 2c d0 89 c1 33 c4 d9 54 16 87 88 e5 de 3a 74 4d d1 b4 9c 94 fa e7 4a 5e 3f f4 1c fc 9f 6a 3e 2e 4d cc 05 2b 9e 4a 47 34 47 96 e9 60 79 f8 74 a4 00 3e 0b 10 ae 99 8f ba 00 ec 46 fd c7 28 34 ab e7 a3 19 cc 01 e2 22 63 f6 58 b4 8d ee 53 56 43 05 bb 14 67 26 3a 02 d0 c5 21 f4 80 73 5e 52 11 88 42 39 ee ad e9 2c 6e 97 90 f6 34 53 29 15 a4 36 76 ed c0 df af 4e 88 b4 d2 e3 10 ee 8b 5e 3d af 42 0a d2 39 94 8c 2f cc 62 ee fb 0d 85 a7 a7 29 59 12 0a 7e 3b d9 e3 9d 35 2b db 41 42 58 85 fe c7 31 25 33
                                                                                        Data Ascii: )c0%3A;/C;F,Y5.$hd&HwZon|jZ,3T:tMJ^?j>.M+JG4G`yt>F(4"cXSVCg&:!s^RB9,n4S)6vN^=B9/b)Y~;5+ABX1%3
                                                                                        2022-07-25 13:17:42 UTC962INData Raw: 7a d8 cb fa bd 52 a6 a4 30 2a fb c1 62 0e 1f 32 d9 c5 1b 1d d5 50 2c f3 c3 6a 7d 67 cc a7 64 e6 57 cc 5c b8 43 df d0 11 1f 67 99 b0 0c 4d 54 d1 ff 70 72 aa 7b a6 20 4d 3e cd d0 d9 77 50 3c 6a 4e e6 d3 58 69 42 e7 16 0e 5b 5b b9 f0 6a 75 1e 48 ce d8 6b 01 64 05 3a 2f 74 6a 54 7a 4d 37 8a 25 ae 2b 09 0b 67 20 a0 76 4e fb 7b 63 24 d8 a9 58 8d 49 4c 0f 0b 9b bb 92 d6 a3 0e 34 24 33 78 9a 84 94 42 7f 15 ae 9e 2f 84 d5 81 31 ab f8 8a 6a 22 2a 30 49 fb cd 79 e6 dc ae fb 1e ce 02 c1 3a b3 be 01 30 24 0c 7a 11 36 e4 5d 0a 5f cb f6 c5 f6 89 ba 6a 8d 20 fe 2d 30 c8 d4 84 15 84 ba 48 99 4e eb 36 89 a6 53 b9 ef 71 cc 52 95 8a 25 ab f8 0e 9d 2e 8f 32 5d 8c 13 cd 36 27 25 7d 01 27 e7 e8 af 10 6f eb 60 cb 16 38 ff f6 1a 71 0b 2e 8a c1 ec 8f 0b b9 b1 0e ed 32 79 a6 b1 b0
                                                                                        Data Ascii: zR0*b2P,j}gdW\CgMTpr{ M>wP<jNXiB[[juHkd:/tjTzM7%+g vN{c$XIL4$3xB/1j"*0Iy:0$z6]_j -0HN6SqR%.2]6'%}'o`8q.2y
                                                                                        2022-07-25 13:17:42 UTC978INData Raw: 5b 1d 92 7a 4b ea 59 cd 42 e4 09 cf 1e bf 10 f2 07 ea 90 61 3d 80 88 af ec 43 02 8a e6 ac 11 a4 81 00 ac bb 1f 91 3a e1 b3 c6 31 b7 0c da 83 51 38 dc a6 19 99 57 06 19 0a 4d 67 be a5 5d a6 0c 41 e4 4a e5 57 40 3f ec 5e 70 a8 a2 21 ac 5b 96 3b 05 9d 2e cb f3 2f 26 f3 e1 6b e6 5d c9 ce 47 07 2c 74 a1 3c 63 b9 77 bc cb 3a 2d fb 52 e5 07 57 be d6 7f 0b 4b f5 f8 1d 74 b3 bb d8 72 1c 91 a8 61 ea 25 4a 65 50 a5 14 9f 6d 83 b2 63 49 89 63 f1 a6 7b 87 4a 0e 01 81 a1 4d 88 67 ea 6b cf c0 7f 55 2c 15 bc 58 88 68 82 9c 93 f2 d4 01 15 07 e4 de e4 32 34 f4 00 7c 24 bc d6 b2 70 9b 04 cd 02 c4 ac fd 12 93 ba ca 71 b6 fb 30 5f 89 fe e6 9f 3f e3 6b f5 83 7f 81 a4 53 49 fa 10 26 da e0 18 18 84 da 56 ab 31 fa 8c ce 7f c9 9d 06 50 56 b9 e2 41 af 18 9a 9f 24 b0 7b 77 68 7c d3
                                                                                        Data Ascii: [zKYBa=C:1Q8WMg]AJW@?^p![;./&k]G,t<cw:-RWKtra%JePmcIc{JMgkU,Xh24|$pq0_?kSI&V1PVA${wh|
                                                                                        2022-07-25 13:17:42 UTC994INData Raw: a8 95 08 f3 0f a3 c8 94 db bf 1a 2f 20 41 0d fa f3 2e 10 ce f8 e6 d4 5c 50 5f cf dd 03 79 e3 af dc d7 f7 ab 86 77 f0 26 c3 bc 89 f1 ac df af c7 a9 66 60 88 1e 0e 87 16 02 15 81 2e 00 7d 13 4e fd 63 e7 e3 59 d5 6f 7d 48 6e 92 ad e4 e3 9a 53 63 58 51 dd 48 51 3b be 24 f4 bd 67 ec ce b3 84 84 47 3f 69 6e 61 b7 0c bb 50 73 ad 1b 1e 3f 57 7a f4 e2 c2 e0 a9 9b f8 b4 70 f9 a7 a3 99 c9 8a 69 48 5b d5 43 54 88 f8 37 7e 7b de f2 e1 62 7e 43 be 09 60 6a 0a 25 ef 90 07 bf b4 b6 65 b8 56 ad 5f 25 ff 3e 57 14 3c 54 ef ad ba 63 7b c9 eb 97 1d 6a 0a 44 fa c0 64 b6 f4 a0 34 0f d7 33 2f 99 fb cc c5 c0 b1 30 ca 6c eb 35 72 c0 93 f5 0f 37 cd aa b2 04 e8 23 cd 5b 02 6d 8d d3 81 c6 34 57 df a8 fc 85 84 5f e8 e0 b4 25 eb 89 a6 0f 1b da f4 97 f0 a2 2a 32 ac 93 75 30 6b e3 2a 44
                                                                                        Data Ascii: / A.\P_yw&f`.}NcYo}HnScXQHQ;$gG?inaPs?WzpiH[CT7~{b~C`j%eV_%>W<Tc{jDd43/0l5r7#[m4W_%*2u0k*D
                                                                                        2022-07-25 13:17:42 UTC1010INData Raw: f1 26 0d a0 a7 9a 8b 65 f2 7d 00 3f 22 34 2c b1 b2 65 d4 c7 94 61 4b f9 ca 63 0f 06 b0 ad 06 5e 61 60 e1 73 32 4d 0e 24 7a d0 ca 1a 48 00 17 0c 6e df f4 05 6f d6 5b 0d 92 90 fd 91 84 27 9f be d5 1d d7 8d 06 78 92 a6 1c d9 dc 46 d6 d1 74 ee e0 29 b1 e0 64 ef fa f9 5a 77 7b ef 13 f1 b8 60 6e 9f 16 cf 12 2b c9 2f f9 93 47 0a 48 77 97 d1 54 a7 3f 82 30 42 19 dc 1a 88 7f cf 98 77 ff 9f dd 54 92 68 37 97 43 5f ec de 55 eb d0 0c c9 65 2a 6f cc 6c 95 c7 d3 52 5e 62 35 d3 72 e8 f3 c9 4e 4f bc 6c e8 0b dd 0f 44 15 07 22 c3 ff 0a a1 5f da c7 89 25 c3 a4 fd b4 48 73 4c 28 e8 40 64 39 85 d4 5c 27 2c a9 d7 e8 16 a8 a6 40 3d 82 86 ec fb e6 ea 0c 99 77 63 31 e5 8e 15 3c 6a b9 67 01 1f 10 11 5a ac fb 53 35 e3 b2 78 3f 34 be 01 61 c9 09 f8 af a1 46 ef fa 34 42 a7 8a 7f a8
                                                                                        Data Ascii: &e}?"4,eaKc^a`s2M$zHno['xFt)dZw{`n+/GHwT?0BwTh7C_Ue*olR^b5rNOlD"_%HsL(@d9\',@=wc1<jgZS5x?4aF4B
                                                                                        2022-07-25 13:17:42 UTC1026INData Raw: eb e0 af c7 48 d7 0d 12 31 6d 72 80 0d 47 26 0e 44 82 9f 40 75 72 7f dc 53 a6 1b 9b 80 b7 d3 c2 1c 1b 5c 16 87 ef e1 3e b8 50 5f c1 f2 ee b5 b8 be 5b 7c 85 c0 27 71 4f 4d 02 3f 04 11 36 33 4e 85 8e 4e 78 98 2e a5 54 a5 44 02 ff f9 e1 75 a1 d2 39 48 c8 7e 60 61 1d dd 7d 74 8c 95 5c 7c bf 99 fa 5a f9 26 a2 f5 d7 22 9f 37 60 78 44 c0 19 63 2b 73 96 c3 60 e3 fb f6 8f 5f fa 96 7d 2f 54 17 ec 22 60 8f 88 d1 69 9b 18 37 84 1a d5 fe 2c ac 58 af 8c 0f 82 95 cc 2e 4b 16 e6 fb ff b9 94 bc ca a1 a8 aa e0 b2 8b cc d1 fb 04 c6 65 80 36 c9 07 ce 56 4c 10 01 3a d7 9d aa 11 64 ac cb 33 15 c8 91 cd 00 41 af 8b ef 54 75 93 9d d2 9d 6f 83 b5 d7 a8 fb cc 54 5d f3 07 7e 08 9b ae 61 c7 3d de ef 04 4e 62 0a c5 78 7d 93 81 06 93 39 af 50 bd 76 66 61 ed 98 21 fe f8 08 9b 69 89 93
                                                                                        Data Ascii: H1mrG&D@urS\>P_[|'qOM?63NNx.TDu9H~`a}t\|Z&"7`xDc+s`_}/T"`i7,X.Ke6VL:d3ATuoT]~a=Nbx}9Pvfa!i
                                                                                        2022-07-25 13:17:42 UTC1042INData Raw: 05 0e 4b 29 5b ac 06 cf 1c d2 fe f5 4f dc d7 f1 07 c3 78 f8 25 92 52 8f cd 0b f2 4e b3 88 9e b9 5e 5e ab 0b 95 75 f4 6f c0 61 81 19 d0 d6 bf 54 a7 dc 76 94 ab ea ad 1c 1a d9 2b 1e a5 1a 02 a4 d0 7c b8 99 90 34 39 7a e7 80 3e 2d 41 60 21 56 6a 78 6c 38 37 85 4a 76 e2 7c 47 cf 42 6f 01 ef 75 82 9c 33 32 44 c7 34 91 38 33 48 30 74 7c 14 c2 69 57 fc 93 d2 55 1a e7 e3 9d da 05 2f 71 eb c9 67 f5 50 c6 8f 79 9e e3 6e 28 0d 17 54 20 ca b8 6e 23 98 3c 89 8c 74 dc fd b8 f5 d3 a0 14 f0 19 13 fc 92 57 62 cb 15 32 57 01 b8 86 28 e5 31 ef a9 c3 7e 7a 66 ad 29 a3 c7 2a ad 45 3f 59 88 67 40 e8 8a ff 0b ce e6 b1 66 dd 01 3f 94 23 38 c4 4a 5f 98 de f1 25 68 a8 03 cb 05 1c fd 4a fb 57 b0 c3 2f 19 60 7a b7 61 52 aa 22 9e 7e 88 13 7a 6c 16 36 ec 9c 12 e3 bd a3 db 2f 96 32 4b
                                                                                        Data Ascii: K)[Ox%RN^^uoaTv+|49z>-A`!Vjxl87Jv|GBou32D483H0t|iWU/qgPyn(T n#<tWb2W(1~zf)*E?Yg@f?#8J_%hJW/`zaR"~zl6/2K
                                                                                        2022-07-25 13:17:42 UTC1058INData Raw: 27 ac 8d 38 50 f0 51 a4 e5 81 02 62 72 8f de 8b dd 78 46 56 fd a8 5e 99 f3 4b b1 2a de 8c a4 10 cd 78 13 cb cc 6b a7 cd d0 8f 67 a8 5c 7b d2 dd 52 90 14 a0 3f 6b 1a e1 94 21 d5 42 e6 00 1a 5f 95 54 52 fd e9 f2 b7 2f c2 c8 6b cc 0d 09 7b 67 89 7d c5 2b 0d 0f ca 1c bf 41 16 c0 fe cd 02 9f 0d 81 d6 d2 c4 50 b8 63 84 d0 ba 2f 68 0f 26 60 41 fd a5 88 aa 46 64 55 6c 51 72 0b 75 00 5f 64 06 d8 cd 41 a5 17 af cd 08 d1 5e fe 37 22 f9 20 58 bc 98 98 bd a4 b0 fc 59 77 2e f6 36 1d ff ba 7f 1a fc 85 5d 00 ec 5a ef 83 84 84 99 5c b6 aa 14 99 35 b8 ae 01 37 8f 24 aa 36 bc 34 6b f6 e3 0b d2 38 99 09 d5 4f a7 66 31 df 98 61 ef e8 b5 61 5e db 35 be 84 4e 6a 3b 4e 05 7c 06 76 b3 6a c0 56 29 98 ca cc 53 40 8b 0a 1b 01 22 69 f4 88 f7 6d 9a b8 28 6f 2e 9a 60 a9 02 48 5b 4d 35
                                                                                        Data Ascii: '8PQbrxFV^K*xkg\{R?k!B_TR/k{g}+APc/h&`AFdUlQru_dA^7" XYw.6]Z\57$64k8Of1aa^5Nj;N|vjV)S@"im(o.`H[M5
                                                                                        2022-07-25 13:17:42 UTC1074INData Raw: 97 8a 83 86 82 d5 0b f0 0a 95 69 97 3c 70 21 9c 97 9b ac 0a 5f 30 a4 ad 9b 18 e1 36 1d cc b3 9a 80 0d b3 4f 6d e8 3a 6d 06 98 cc 7f c0 8c 0a 6e b3 c4 b3 c4 ba 36 cc dc 7c bd 5c 25 43 62 86 88 44 f2 a1 2c e3 c4 88 05 53 69 92 f7 b3 bc c0 eb 1f fd 37 a0 a6 06 9d 1c 04 bc c1 21 94 75 4d 8d 8d a7 3e 4a 58 ae b9 3b d6 84 97 8e 38 d5 fe a5 1b 67 c2 6c 1c 7f 85 bd f3 64 08 7e 57 e3 bb 9b 8f 7b 3e 2c 8c 3d 13 f3 7a ab 01 3d 7d de 45 b4 32 27 5d 5a e2 05 3f d2 5d 76 e8 2f 69 86 7b 58 4b 59 4f 44 c0 d6 b0 47 c5 ba b7 a5 b7 32 48 4a d8 f4 61 55 ca 05 42 72 05 fd 3b f0 7e eb ff 1f c8 d3 4b 8e 09 3b 2b fc 7c 89 cf 45 02 f0 80 8a ba 27 98 77 e7 af 3c de 18 24 03 f3 7f 6f 54 cc 93 2f 0e 53 0f ac d7 31 66 49 e3 aa 18 e0 61 3a 3d e8 cf f5 05 72 92 6b f3 78 11 f9 7c 3c c3
                                                                                        Data Ascii: i<p!_06Om:mn6|\%CbD,Si7!uM>JX;8gld~W{>,=z=}E2']Z?]v/i{XKYODG2HJaUBr;~K;+|E'w<$oT/S1fIa:=rkx|<
                                                                                        2022-07-25 13:17:42 UTC1090INData Raw: bc 33 1a 94 22 35 4f a3 8b fc 18 49 3e a5 0b 96 09 65 6d 51 ef 23 04 e9 35 6a ce 99 3f e9 37 c7 5e fd 88 ab 4a 9b ad e3 e4 6e 76 35 7e b1 10 c5 51 61 a2 ff b2 b3 a0 87 23 74 4c db 2d fe ef d2 1f e6 cc 32 b6 94 fa 2e 3f 1c e0 b4 a6 25 81 5e c9 e2 7a 5f 6e 94 cc 49 35 8f 83 e5 d0 32 3f 1e d1 be a7 16 c8 78 f9 22 17 15 e7 04 65 61 e9 92 e6 94 a2 1f 3f 0c ff 4a 12 09 ef 17 e1 ab e1 82 25 3a d8 04 a3 4b 39 bd aa f2 4d 37 21 5a 83 dc 86 b7 dc 79 a6 34 2e 28 99 d4 20 d3 9d 00 d1 1c df 8f 5e 47 0c 2e bb 11 38 8b 2f 92 25 82 e3 85 be 15 58 c5 5c 30 84 c0 e5 79 17 70 12 49 82 24 9c 52 5b 9d 51 96 aa 67 61 86 54 3d 03 fd 2f 30 c2 fb bf 09 bf 41 9a 9a e4 54 b6 a2 f9 42 2f 55 b3 3e fe 32 5d 55 76 ca 29 fc cf ae 44 5d 0d af ce 1c ef 31 a6 78 9f 92 90 f5 b4 9a 84 8c ae
                                                                                        Data Ascii: 3"5OI>emQ#5j?7^Jnv5~Qa#tL-2.?%^z_nI52?x"ea?J%:K9M7!Zy4.( ^G.8/%X\0ypI$R[QgaT=/0ATB/U>2]Uv)D]1x
                                                                                        2022-07-25 13:17:42 UTC1106INData Raw: 11 db 42 ec 6c c6 9a 87 78 8c bc 92 3a 54 82 cc 37 85 5c 79 ff 31 7c 08 9d 70 bd 79 81 b4 16 24 31 57 d4 b5 ca 9a c1 73 e4 ad ea 52 63 2f af 25 ca 59 5e 30 bf 78 41 b7 3a be 57 59 2b da 5a 3a 55 45 d1 3a d0 03 56 e1 5d fb e5 ba fc 8f c9 7f 9d 8c c5 9b 01 e1 d8 28 16 85 b1 13 94 b4 59 67 9d 52 57 77 de 85 1f f5 bb d0 99 04 3c ab e3 56 7b 16 c9 ba 4c 39 10 2e 85 08 6b 40 ba 35 a6 fc c4 58 89 b7 e2 19 6a ba 1d e9 c3 c7 74 cc 8e 46 28 3f 43 89 5a ff 02 a6 b4 c4 33 c1 27 f0 db ba 2c c4 3c 35 a5 16 9e b6 3b 7a ae 40 23 dd 8a ac 00 38 53 12 86 fa c1 48 c3 41 0e fe e3 6f 8d 5f 0b f9 81 92 e2 6d ef dd 8a 74 65 29 ba f0 6e 5a 24 f9 97 25 c9 b9 a4 1a e3 14 11 92 c1 5d cb a2 3b f0 bf c9 85 7a 6b 1b 0c 9f 7a a6 18 bd 4a 04 4d b2 60 56 19 82 3d 88 72 fd 9d 1c f3 27 e1
                                                                                        Data Ascii: Blx:T7\y1|py$1WsRc/%Y^0xA:WY+Z:UE:V](YgRWw<V{L9.k@5XjtF(?CZ3',<5;z@#8SHAo_mte)nZ$%];zkzJM`V=r'
                                                                                        2022-07-25 13:17:42 UTC1122INData Raw: 78 25 df 72 7a 6b 95 a1 dc 39 ca d8 d3 55 dc ff 6f 97 03 20 22 57 48 ff b0 9b fa c6 ef 2d ce b3 22 4f 0c 51 eb 8e 66 a7 5d c3 76 f2 d4 c8 ec cc 68 6b a7 63 0e 7f 66 49 8b 13 25 b4 9e 9f 58 34 fb 73 80 3f 3f bc 5b cf 7b 43 f3 50 bc 7b d0 07 de cf aa 9a 41 3d d2 db 58 35 ad f5 bb b3 81 8a 22 f7 d7 b5 7b 22 c8 5b 43 7b 41 d8 9e b2 ea 55 6d 99 a4 37 e8 14 24 ff b0 df 1b a3 fb 57 a3 04 c7 97 fc e2 46 9a 1f 6f 26 0d 27 f6 d0 bd 2a 08 38 42 e3 a6 36 20 24 54 aa 4a 71 58 66 2a 13 17 12 f5 d6 d3 6a 1b 6f 44 00 56 a7 8a 7c 43 99 46 fe 63 14 d8 24 40 2f 41 2c fa 16 61 01 b2 84 31 72 b5 9d 62 2b bb e6 d4 86 b3 cc df 72 e6 5e cc c1 a6 b1 6c 47 f6 78 f2 24 da 50 a1 77 5e 10 95 88 95 3c 9b 0d 30 c7 74 e9 40 35 63 3b 62 ba 6e bb 71 08 4f de de 5c 5f b5 d3 06 6b a0 53 d0
                                                                                        Data Ascii: x%rzk9Uo "WH-"OQf]vhkcfI%X4s??[{CP{A=X5"{"[C{AUm7$WFo&'*8B6 $TJqXf*joDV|CFc$@/A,a1rb+r^lGx$Pw^<0t@5c;bnqO\_kS
                                                                                        2022-07-25 13:17:42 UTC1138INData Raw: 65 9a 88 46 28 9e 6a 19 c2 eb 7a ad 72 b0 ee 50 02 f7 8b a1 bc 45 4f c5 1c 63 e6 33 82 68 d9 46 a0 10 62 4d 54 36 16 96 85 2a 2a 9d a3 ac f7 ba 01 56 82 60 28 89 79 c7 4d f4 6b 4a 78 4f 5b 63 dd 46 cd af c4 32 43 10 0c 92 96 77 64 05 4e d2 4a c7 cd fb d4 14 1d 5b a4 3a d7 03 0b 42 74 a2 d4 c5 b3 bb a5 52 e0 cd 49 40 36 ff 9d 65 1c 24 aa 8e 75 65 7b bc 06 4d da 44 fa f4 8a 01 01 85 15 9d b3 16 57 87 b0 3e 2d a5 9b 48 3a ca 57 ad 16 32 44 29 b1 8a f6 9e d1 1b c5 38 4d 7e 9a 02 f6 de 1b f7 87 46 6c 20 b9 5b 86 56 69 af 7f 35 07 d1 88 e1 ba e5 81 c0 6b 08 5b 30 5d c7 af ce 03 55 5b 91 90 fa 0e 43 45 02 85 8f 2c 04 a7 f7 70 ff 46 8e ab 20 eb 06 68 f2 d4 fd 80 97 12 06 d2 12 21 5d f9 02 bb 10 00 e1 be ba 14 1e 85 99 bd 35 d1 9a 66 9e 51 23 6a 03 f7 fb 92 8e 05
                                                                                        Data Ascii: eF(jzrPEOc3hFbMT6**V`(yMkJxO[cF2CwdNJ[:BtRI@6e$ue{MDW>-H:W2D)8M~Fl [Vi5k[0]U[CE,pF h!]5fQ#j
                                                                                        2022-07-25 13:17:42 UTC1154INData Raw: 7b 3a 0c 9c 6b 89 0c 8f 5f 52 15 e7 6b b8 c4 95 c9 a8 1d db 4f 7b 4e 2a 56 e2 85 0e 7c 0f 45 d6 6c 3d ff 2e 8f 72 85 42 d4 5e 24 0f 45 9e ee de bb 6c 2a 1b 33 a8 77 60 dc a0 f7 89 01 1b e0 5c 0f d4 71 9b c9 59 2a 37 ad b4 15 9f 7f 32 82 20 10 cb 29 c3 36 cd 98 9a 58 ac b7 5d c4 ef a8 db 1d 49 63 0d b8 7a 2e dd 5b 64 95 64 20 0c 2b c2 b7 22 38 e6 0e 28 06 8e ee 2e 2c b9 d9 46 0d ef 3a 99 00 d6 b4 af a5 8b 5a 78 71 cc 77 ca be 33 d9 cc 2b cd ed 97 dd 92 23 ea 45 c7 5a a2 21 08 aa 29 7e a2 aa a5 cf 5b d3 0a b8 d9 de a1 3d 38 90 2a 37 f1 42 61 0b 25 c7 f4 6c ef 04 de a5 23 b8 d5 37 d4 ef 5a 32 be 4b ef 06 c2 6b bc d0 47 cb 00 54 c6 e2 96 88 90 86 85 0f d9 e4 26 c8 ff a4 e2 61 24 b2 ed cb 67 3b 3d 06 1a 6d 68 02 5c fb b3 d2 eb 2f b0 dd 43 ab aa 5e 27 b1 28 19
                                                                                        Data Ascii: {:k_RkO{N*V|El=.rB^$El*3w`\qY*72 )6X]Icz.[dd +"8(.,F:Zxqw3+#EZ!)~[=8*7Ba%l#7Z2KkGT&a$g;=mh\/C^'(
                                                                                        2022-07-25 13:17:42 UTC1170INData Raw: 68 82 0f f5 b6 00 ad 5b 04 38 04 16 2b b7 95 61 d5 f9 e4 ab 3b 73 de b5 b2 e6 f9 b3 8f 24 68 b0 75 43 c4 3d e2 a7 ed 30 49 34 35 a6 a7 d7 7a c0 15 a0 8a b9 f8 f9 16 b9 88 41 0d 4a 23 4d 7c 23 b2 17 d4 b2 77 9e 22 8a 6d 8f 62 cd a9 2e 8c ee 7c 39 14 53 95 38 53 83 7f 75 29 92 ae 12 91 5c d7 0e 62 25 a8 12 89 97 7e a0 81 65 0e 48 b4 1b f0 66 c7 1c 7c 2a 54 b3 9c ff 6c 21 ed e0 34 02 e3 0a 25 6e 1f 2e d8 2d 75 7d bb ad 7a 16 0d 7a c7 2c c4 8c 55 93 6f ba 19 07 91 df 14 e3 48 32 df f8 8c 43 be 0c 27 9b 45 f5 46 f9 4e e0 59 65 6c 45 5e 0b 7f 14 4b 56 7c 42 b2 a9 ec 9a 64 cb 8c ba 48 df 96 04 22 ab c4 38 f3 e0 af 5b f5 75 fa 54 86 52 61 e8 79 16 60 5d ae 52 3b 1a 8f 7f d1 89 88 84 35 30 0f 3d 29 e3 14 8c 1d eb 4b 38 80 5f f3 eb bc 2d 42 09 3c f2 11 98 cc 3c 99
                                                                                        Data Ascii: h[8+a;s$huC=0I45zAJ#M|#w"mb.|9S8Su)\b%~eHf|*Tl!4%n.-u}zz,UoH2C'EFNYelE^KV|BdH"8[uTRay`]R;50=)K8_-B<<
                                                                                        2022-07-25 13:17:42 UTC1186INData Raw: 9b a4 53 85 a1 16 a0 45 1f 76 e1 fb 21 c8 98 02 4c e1 65 25 53 25 4e 32 96 82 c8 d8 47 b8 be 83 b5 66 7e dc 46 b7 d0 33 af ae e2 8a cc a6 a6 e0 91 68 52 73 47 ee 40 96 9b 96 53 12 35 1e 8d 84 23 e0 61 ef 90 0f 53 ed 05 5c 9f 34 60 14 9f 06 bf 1a 20 09 87 84 8c 56 69 5d 1b 35 5d 39 09 eb 8c 8e 20 e5 42 f2 3d 21 a5 17 e3 8d 16 09 7e 92 ee 0b 7a 76 8e d1 cc f4 e3 db f6 25 79 45 a4 53 d5 08 1a 47 6b 88 82 b3 5b 7c c0 92 66 a5 f6 83 c4 bf 12 8c 63 20 ca cb 7e 89 11 3b 63 e5 bd 5f 1a 50 f7 38 f2 f2 ce df fc 87 0e b4 53 47 48 77 d2 3b dd 11 65 3e 45 b3 d2 c6 10 6a 0a cf 71 d7 52 a9 af cd ff 1b de 7a 31 e6 b8 d7 8a 1f fe 9b c6 0b e1 c3 a8 3d 1b 88 e8 5a 51 4c e5 cb e7 9b 2f 32 ae 68 e3 85 32 1f 20 04 c6 70 2c a5 93 8d e4 7e 7d b0 98 08 8c 09 02 ca 56 8a c1 93 9d
                                                                                        Data Ascii: SEv!Le%S%N2Gf~F3hRsG@S5#aS\4` Vi]5]9 B=!~zv%yESGk[|fc ~;c_P8SGHw;e>EjqRz1=ZQL/2h2 p,~}V
                                                                                        2022-07-25 13:17:42 UTC1202INData Raw: 73 ab d9 6c d1 75 03 70 9c 41 ea 7b 9c 79 9d 77 c5 01 00 5a d0 11 8f 2d 92 26 ac 66 5a 0e 16 9c 35 bc 74 7c 16 58 d4 78 01 ee 0d 73 a1 9c b4 5d f9 f6 c0 e5 16 df 1e 68 bc a1 14 cd 34 24 e7 a9 a9 65 7c 0e 89 05 a3 f8 1c 1d d9 63 c1 59 0e b3 af 28 5a 08 04 e4 79 6e 9f 62 8d d5 d8 0f e1 a6 46 cd 60 5e 59 3f 41 9c 76 9e 40 96 4c e4 ff 90 cc 48 84 64 56 ac cd 42 61 c8 de 69 7f 72 a1 f9 91 4d 30 3f a2 f7 88 9e 21 5f cd 6e a4 b7 7d af e5 6e c8 fd 62 62 19 cb a9 e4 86 3f 0a 3b 0d 64 3b c9 8a d9 57 df 95 c2 93 72 84 9c 8e 79 42 da ad 75 c9 f4 26 06 63 61 55 f5 17 48 a2 5a e0 4f b4 da 4a 85 13 39 57 00 a0 93 14 52 aa 60 d6 1c 7b 6a 94 4c c5 a0 ab f0 6b 85 20 a3 d5 ab 63 e5 6c 3a 74 be 66 94 c8 7d 7a dc 32 8d 36 6c 68 3b 98 8f 8e 97 99 57 6e 15 dc 12 dc b1 c2 3c 4a
                                                                                        Data Ascii: slupA{ywZ-&fZ5t|Xxs]h4$e|cY(ZynbF`^Y?Av@LHdVBairM0?!_n}nbb?;d;WryBu&caUHZOJ9WR`{jLk cl:tf}z26lh;Wn<J
                                                                                        2022-07-25 13:17:42 UTC1218INData Raw: e2 26 7e e6 d7 e8 41 b4 b6 5d 01 37 ad a1 da 7e 88 fb b7 9d 7d 1a 93 42 5c 6d d3 1e 86 68 2b 71 bd 04 b8 ea 3f 5b 34 3b 8f ca 0d 9d 8b 13 7d d6 71 df f9 89 80 30 ed 0a 1c 38 7e de a1 b0 6e 69 89 f0 46 c3 d2 cd 73 b8 35 a3 8d ea 0f 3d bb 74 b0 a3 c1 aa 3d 13 dd ae 52 02 f0 e5 f2 e9 1a d8 2b ea ad e1 a4 98 68 b2 dc 98 c2 c3 e2 9e 39 68 1b b1 4c db 09 e7 c9 0e 7e 0c 92 1c d2 3e 4b cc d8 a2 9c eb 1b 61 ac 27 7e 6e a5 fc 33 51 ad 9d ae ed c8 18 b5 35 98 fc 59 89 1a 0a 3f 41 9c cf 73 a2 ce c6 a7 82 0c 47 b1 53 65 7c 70 aa 9b 80 48 fa 70 6c cb 5f 9a 64 5b 34 55 2a 88 2e 03 9e 90 82 f1 58 0e 41 39 1c af 24 5b ab 85 e2 1f d7 21 5a b6 15 43 9b 9c 0f e0 90 12 07 b2 0b 29 17 84 8e ef 43 96 48 0e 80 6b a1 41 54 23 e3 a5 13 79 8d 12 18 ff a4 28 16 6f 78 93 da 3d 0c 22
                                                                                        Data Ascii: &~A]7~}B\mh+q?[4;}q08~niFs5=t=R+h9hL~>Ka'~n3Q5Y?AsGSe|pHpl_d[4U*.XA9$[!ZC)CHkAT#y(ox="
                                                                                        2022-07-25 13:17:42 UTC1234INData Raw: 19 a4 dc da a6 6b 39 a6 6b f3 18 02 41 d1 a8 d1 f8 9a a6 7b f5 a5 ce cd 6a 01 58 73 18 0d ab d4 3b e6 c9 a5 ac cf 3a 92 49 d5 83 9d 6c b1 ea 8a a7 c3 fc 1f ee 8b 7c ae 49 0d ee 7f 98 81 53 fc 26 3f 36 64 a9 91 3d f3 1b af 30 01 26 97 8c cb 06 2e 08 77 84 54 78 b3 db 18 9e cb d5 48 55 4b 87 6a 2e 56 89 41 4c 69 58 15 52 d6 a7 31 97 8a b1 e1 72 98 f1 dc 57 21 23 70 88 87 62 2d 8a 28 d9 43 06 c4 f7 53 33 e2 d3 d9 4a 78 72 dc bf 54 d8 ac 59 ca 89 42 fc 5b 4c 93 1d 91 d1 20 55 b3 22 e4 cc 5f f9 17 29 06 3b f0 cf 7c 16 8a 3d 26 2b f0 aa ef 01 e9 86 69 7c cb cb b5 c3 ac 21 6e 42 d4 30 bc 6d c8 e8 92 21 0e 45 d9 0d 66 ae 1b 95 3d 1c ee 09 ed eb 01 49 33 99 b9 76 b9 c3 f5 34 05 48 d1 53 5a 61 23 d5 9b b6 f4 0b 2e a5 f8 92 ee fd 78 24 30 b7 44 fc 4e 78 f9 34 63 9d
                                                                                        Data Ascii: k9kA{jXs;:Il|IS&?6d=0&.wTxHUKj.VALiXR1rW!#pb-(CS3JxrTYB[L U"_);|=&+i|!nB0m!Ef=I3v4HSZa#.x$0DNx4c
                                                                                        2022-07-25 13:17:42 UTC1250INData Raw: 4e 0a fe 59 d8 5a 43 3c c9 14 50 65 4d 8d b1 e0 2f 64 2d 8e f8 e0 01 d8 01 49 9e de 44 04 31 d8 c4 63 a5 b8 a2 5a f8 2d 5b 68 eb 93 4d 52 5d 27 06 0e 45 9d 64 ce 03 d3 ba 82 ce 4f 1a df a1 49 3a ce e9 f0 9e 30 19 bd 1f c7 e2 14 71 de 01 70 db fe 33 0f 9a 90 20 40 40 3b 08 c9 cf 34 7a 4f e5 34 07 85 cf 05 c0 48 3a cd aa 97 b5 20 dd 4b 25 60 c0 f6 89 f5 a4 b8 13 9f 4e 78 fc a5 cd ba d9 c0 05 2e 97 d6 3f 52 72 06 38 02 12 3e a5 dd 70 55 b6 0e 96 35 2a 38 2a a3 6d 39 ae ae c1 c9 95 7d 45 ca be 8b 5d 06 15 8d 07 23 2f a5 cf 58 31 fa 58 59 06 43 60 02 94 6a 7e 2a a2 40 4c db 8e a5 57 35 38 6d 4b 7e be 95 1b 13 08 ec f3 43 02 d8 f1 f7 39 a0 b3 73 a1 d5 63 e2 64 ab d6 95 85 5d ff 18 c4 8a 3d 96 60 9c 5c 8a 90 5b d1 c3 a1 bb 42 ca 10 68 3c 02 5a 6e 22 ef 3b 52 1f
                                                                                        Data Ascii: NYZC<PeM/d-ID1cZ-[hMR]'EdOI:0qp3 @@;4zO4H: K%`Nx.?Rr8>pU5*8*m9}E]#/X1XYC`j~*@LW58mK~C9scd]=`\[Bh<Zn";R
                                                                                        2022-07-25 13:17:42 UTC1266INData Raw: 3f 9e 21 9a 64 e7 fe 4c 75 22 ea 74 26 d2 16 a8 73 e5 a3 2b 20 e9 d1 a1 e4 1d ed 5d 81 5b 82 71 54 36 fb d5 a6 1c 1a f0 3d e6 7a cc c0 f9 68 1d 87 de 06 45 c9 61 fa 84 2e 92 30 d9 46 0b da fc 13 29 02 e9 8c 31 c1 e5 82 bc c1 3f 38 7f 4a d7 66 0d db 15 48 a8 58 fa 19 54 b4 d3 a1 a9 99 2d 97 ce b6 8f 31 af d3 0c 8c 35 ca 66 06 36 8a 12 f8 32 54 42 49 ec 7a 35 fa a2 98 7f 2b 64 c4 67 cf 26 e2 8e d6 e8 2d 54 ee d3 a3 27 eb b0 52 0c d6 14 ad ff 8a d2 2a 52 5f fa f3 22 6d eb ac b6 f3 01 cb 27 d6 4f 03 77 73 30 89 b6 97 c8 fc 96 b5 87 e6 df 17 66 0c 80 eb 8f cd 60 cb 88 bf 7e 82 bf f6 6f fb 70 87 27 a7 7d e7 f9 dc e9 29 c6 8f dc 6e bf 77 f9 3d db bf ce 40 5b 76 e0 ac 46 68 9a 1e f6 c3 b9 b9 26 6c 03 a6 9c a4 24 db 59 3b e9 84 69 23 c7 eb f6 3b 36 e2 70 8c f2 7f
                                                                                        Data Ascii: ?!dLu"t&s+ ][qT6=zhEa.0F)1?8JfHXT-15f62TBIz5+dg&-T'R*R_"m'Ows0f`~op'})nw=@[vFh&l$Y;i#;6p
                                                                                        2022-07-25 13:17:42 UTC1282INData Raw: 0d dd bc 79 40 28 65 92 36 df 46 15 96 1a d9 f6 e0 d4 cb f5 bd 55 4a 7d 5d 68 5f 6c 24 16 cb a6 6f e4 3d 5a 23 32 1b 47 0e b3 ac 06 fa 35 94 2a c6 bb 11 4a ad 2c ff 11 59 10 c9 ac 02 83 59 74 6e dd 95 e5 aa 22 0c 80 f2 a1 fe 3a b2 38 96 02 5b 05 af 1b 70 9c ab 7f d5 cb ee 09 43 e6 ae f1 8b 1f 39 92 ab ce c0 fc 42 61 74 14 c2 60 6a 82 34 cc 00 15 17 a0 95 ca 3b 79 0a cb 8a fa c2 cb 7d 40 a2 75 d4 44 ce 50 07 06 79 31 21 11 10 99 ca f5 bc 7e 76 8f 04 a2 19 83 42 9a 7e d5 02 ff 9a 17 50 8d ae a9 58 58 eb 7f e9 84 26 f7 38 6f d0 a7 a2 1e e5 2f 2b b8 a1 8b e8 61 6a 69 18 75 60 f8 b5 3d c0 20 96 d6 12 4a 1c 68 f2 98 11 b3 db 72 61 fe ff 0b 70 6c 19 c3 f0 25 d3 67 40 a1 04 00 dd 45 71 83 62 da ce 58 89 f1 b0 da fb b4 82 c7 0f a2 55 60 88 08 74 51 97 dd 16 3a 7a
                                                                                        Data Ascii: y@(e6FUJ}]h_l$o=Z#2G5*J,YYtn":8[pC9Bat`j4;y}@uDPy1!~vB~PXX&8o/+ajiu`= Jhrapl%g@EqbXU`tQ:z
                                                                                        2022-07-25 13:17:42 UTC1298INData Raw: a9 0d ba 64 e6 57 27 28 98 f8 5c 77 7d 73 97 60 fd 77 68 c7 46 ac 10 95 2c 07 17 85 78 98 ad 32 6d 5b aa 2a 24 06 4b 3f cc 26 d9 ff cf d0 a3 07 2c ba d4 48 db e7 ff bb 71 24 7d c6 97 e6 d6 b5 b5 51 f1 78 ca ec d6 b6 58 c1 30 ab 09 b7 f3 71 97 2d ed 90 ad 34 79 72 71 f4 60 17 df bd e8 e0 5b 1f 43 20 04 7c 82 b1 93 ab ea a9 d2 1b f5 3b fc 81 df 14 c6 f4 0a a4 33 e5 39 96 7a 32 36 2a 7e ba a9 ba 88 92 d0 71 cc eb 15 01 42 61 59 2f 97 b8 50 11 cf bf 2e 3f 9d e1 ca e9 55 78 65 04 ba 29 b3 4e 8f 1b 7a d6 41 68 41 8b f8 bb 1e a4 2e 0c 93 92 1d bd 5f 77 2b 55 ef 0a 21 20 bd 78 c4 ef 06 fe 78 40 4e ab 1b 54 be 7a 87 12 4d 47 bb 7a 96 70 4e 60 fd 30 d4 48 33 76 09 9e e6 c0 a4 42 99 b4 35 75 a1 5a 26 d3 d6 cf ca 8e 2f 59 d2 cc 4e 35 d5 7d 55 5d 37 93 9f 70 a6 c4 a7
                                                                                        Data Ascii: dW'(\w}s`whF,x2m[*$K?&,Hq$}QxX0q-4yrq`[C |;39z26*~qBaY/P.?Uxe)NzAhA._w+U! xx@NTzMGzpN`0H3vB5uZ&/YN5}U]7p
                                                                                        2022-07-25 13:17:42 UTC1314INData Raw: 26 e2 df 3f 46 f0 9e 5b ba 33 ad d5 ec 2b 2c e1 89 bf 1f 8a 96 57 e7 f5 f6 01 aa f9 ab fc fa ee 42 7d a5 84 99 13 86 7d 95 d0 04 ae bc 4d 19 62 91 17 67 c5 63 29 00 76 40 da 07 f4 3f 85 86 27 94 8f dd d0 e8 b0 8c 95 44 d5 54 b8 0f 09 1b 0a 6a 2c 7c 36 7a 18 db 98 38 ae 73 a1 b0 d3 13 29 f1 b3 18 eb 5a 16 22 7e 28 59 3f ec bb 65 c6 5c ed 75 f4 04 8a ed c6 b8 70 ef 69 9e ad da 6a 93 f7 32 ef 14 42 61 0e 53 14 5a fb 90 35 c7 a8 f3 8f 86 aa 77 56 8a 0a 39 20 d0 50 f0 6b 7d 80 29 94 bb 79 62 3e 51 65 43 9d f3 a4 be 7e e3 14 8a fb fd 82 ca 6e bf 70 88 32 43 63 23 79 e8 93 d9 69 50 9d 4d 6d a9 b8 af 55 e1 bd bb 2c a9 fb 4f de 50 13 5a ec 18 25 95 8c 1f 84 57 ca 2a fc 9a 89 62 cc 94 1f 39 f2 06 95 4c 44 cc da 6e 12 23 48 64 f7 d3 88 66 d2 ee 1f 0b 24 8b 7a 3c d0
                                                                                        Data Ascii: &?F[3+,WB}}Mbgc)v@?'DTj,|6z8s)Z"~(Y?e\upij2BaSZ5wV9 Pk})yb>QeC~np2Cc#yiPMmU,OPZ%W*b9LDn#Hdf$z<
                                                                                        2022-07-25 13:17:42 UTC1330INData Raw: bb ce ad 89 cc 4c d8 39 e1 91 eb be 14 65 bd 44 a5 c0 00 ec 16 c8 90 73 89 75 6a 0d c7 fc e1 2e cf 1a f8 46 c6 16 1f d9 79 85 6d c0 92 dc 90 14 61 d2 19 03 f2 2c 2d 39 e7 2a db 67 dd 6d 89 db 38 ee bf e0 6f 05 d6 50 65 dc 15 56 b7 d8 b5 e5 68 0e ad ca dc 1a f7 8e 52 86 d0 64 ac 06 32 5e 22 03 fe 3b 21 fd 8c a3 ab f8 d6 36 f7 54 78 cb d7 b5 62 1f f2 46 57 0b d1 11 03 8b 9a 5e 6b 27 78 43 c3 ad 69 4b b7 ef 4f 97 2a 3c 2c 4f 53 60 3a 68 08 bd 8a ac ac cd 19 a3 b7 7c b0 33 e9 9c e3 2f 4a 29 fc c3 f2 e0 cd 32 d1 31 7c d7 c9 7f 4b fa d8 11 03 8e 99 35 f8 f0 78 4a 37 a8 84 0e a4 07 b4 21 7d 7b f7 f6 09 0a e2 f2 a8 ad 56 1d 1f 68 39 ba 84 54 5a 10 9f 2a f8 e3 3e b0 71 e1 2d c3 22 8f 89 1d 8f 1c 98 43 f5 30 2e 92 20 c5 04 10 fa 82 89 4c 18 c7 57 f8 26 6e ba 6f 94
                                                                                        Data Ascii: L9eDsuj.Fyma,-9*gm8oPeVhRd2^";!6TxbFW^k'xCiKO*<,OS`:h|3/J)21|K5xJ7!}{Vh9TZ*>q-"C0. LW&no
                                                                                        2022-07-25 13:17:43 UTC1346INData Raw: a6 8c cd b0 e4 0c 0e 00 16 d7 d1 77 49 ed 15 5e f5 2f c9 d1 24 8b 07 83 2c e5 47 89 c1 cb c1 62 7c 81 47 77 1d d0 75 6b b5 01 c2 30 4c 15 8c 8a b3 20 05 9e 29 60 21 ad 2c 48 a8 54 30 dd 55 d9 08 aa 61 ac a2 61 7e bb 1d 47 00 de 38 c8 62 2b 25 e0 72 99 20 55 24 46 65 30 8c 29 b9 ce 7a 37 52 56 26 5a 61 86 e4 5c 66 57 84 a7 db 90 58 3d a4 84 a1 27 cd dc 3c 13 0e bd 1d 1a 97 c6 a5 5e 99 2c 77 dc 8d c4 e0 63 90 51 5e 75 20 a8 b8 b4 ee 2b a7 9f 9b a4 26 14 f4 1f ac 83 73 33 59 e4 37 fc 57 d6 f8 f0 3c 36 80 a8 cd b7 27 55 c2 03 1c 33 30 ee 57 90 e3 b8 f4 e8 bd e2 35 a0 12 68 f1 e7 06 75 63 56 e6 67 a9 74 08 0e eb 7a 2c 68 4e 3a db 26 e8 33 53 67 f3 8d 7d 19 9f 9a 87 4f b1 ab e9 17 be 36 d5 88 98 10 c2 1f af 52 19 e7 a8 67 e7 24 c5 1a 4f b9 75 f7 1d 32 bf 03 02
                                                                                        Data Ascii: wI^/$,Gb|Gwuk0L )`!,HT0Uaa~G8b+%r U$Fe0)z7RV&Za\fWX='<^,wcQ^u +&s3Y7W<6'U30W5hucVgtz,hN:&3Sg}O6Rg$Ou2
                                                                                        2022-07-25 13:17:43 UTC1362INData Raw: 8b 86 83 80 a1 78 39 e2 8c 14 dc 88 5b 55 ac 2b 8d 3c 78 56 cc 8a 8b ca af de 51 6b 49 10 6e 9b 04 69 72 38 a6 7b 6b fb ae 46 7e 50 16 53 a3 bf b6 07 48 f8 2b 78 0a 1b 21 7c db 1b f6 07 2d 43 5b 16 3a 2c 5e 29 ac 96 17 72 aa 8b 0f 06 94 8e 12 36 bd 86 e7 b1 04 70 9a ef a7 e2 2f bd 44 bd de 99 b9 f4 79 44 e0 ba 6c 93 75 03 a9 08 dd 74 d0 ef 96 fe 98 56 be 36 a1 4e 9c c3 10 14 78 d5 a4 f0 c9 af 71 6a f4 bf 39 05 24 12 a0 35 af e1 26 7c 68 d8 51 96 d3 f7 5d b9 97 5b 06 f6 bb 1f 88 66 52 42 e4 56 10 04 47 26 b9 26 24 ea 14 25 13 49 d2 ee 49 c7 33 3f 07 ec 62 7a 41 d3 fd 24 3f 70 3f 1e 40 ca 32 bb 54 09 88 4e df c6 7f 1f 01 43 85 3a c5 cb 23 d7 aa f8 23 6c 64 a3 40 bf 8c 82 f6 e9 1d 48 17 39 72 8d 01 37 37 ed a7 6a e6 3e 35 d4 02 d4 93 84 44 e1 66 80 45 6f f5
                                                                                        Data Ascii: x9[U+<xVQkInir8{kF~PSH+x!|-C[:,^)r6p/DyDlutV6Nxqj9$5&|hQ][fRBVG&&$%II3?bzA$?p?@2TNC:##ld@H9r77j>5DfEo
                                                                                        2022-07-25 13:17:43 UTC1378INData Raw: 87 78 7e 3f 5d b9 2d 09 1b 16 e2 6d c1 2b e3 60 90 3e 4c a7 7a 04 f3 58 09 ab 38 69 98 00 ff e1 66 f9 d4 e7 7f da d8 76 af 05 1a de 00 5f 8b 8e 0d dd 96 45 b8 c5 42 19 0c 50 31 59 a7 ba db 9c 8f 7d d4 8e 60 1a 48 8d ed 00 06 2c 97 cc bc 55 82 48 6a 48 6c c1 74 c8 48 2d 6a 26 db ff 12 43 85 15 fc 29 cf f0 c7 d1 50 b2 9f 6a ef e4 7b 0a a1 b6 a2 57 7f 0e ff 05 07 8c 71 a5 7c 1a 57 29 08 ef 79 50 76 d4 7c 4f c9 20 6e 76 51 5c 41 91 77 5e 8e 5a ae 74 05 a1 de d0 06 8a 80 dc 86 99 0c 45 3c ff eb 5f b9 65 69 18 80 07 41 52 86 65 52 2d 5f 0f 9b 6b 72 01 9b 34 06 d3 2b b1 66 66 60 86 70 4a 67 2a 4a 53 fb 8f 3a c2 3e bb 8b 6e 9c b5 19 b4 5e 56 1b e9 18 ad 41 50 ca 1f ba 60 9a dc 06 d1 bf 7a 17 0e e2 aa b6 8e d7 27 08 e6 c2 bd 02 36 c6 a7 ed c9 7e 59 ef 61 bd 0f 7d
                                                                                        Data Ascii: x~?]-m+`>LzX8ifv_EBP1Y}`H,UHjHltH-j&C)Pj{Wq|W)yPv|O nvQ\Aw^ZtE<_eiAReR-_kr4+ff`pJg*JS:>n^VAP`z'6~Ya}
                                                                                        2022-07-25 13:17:43 UTC1394INData Raw: c8 6b e7 e2 cc f1 a0 eb 34 5d 56 ed c7 1f 01 3b 4a c3 e3 64 32 7f 90 96 ce 09 c9 2b c6 eb 71 63 99 e4 c1 a6 92 4f 4d dd f5 f5 c2 d3 15 bf 77 86 ce 55 3e af 63 60 eb 16 ca 0e e9 22 51 2c db 49 8d 7e cb 06 13 92 8b 73 c2 0f 98 b9 c2 9f 81 24 48 e6 2e c7 6a ef d0 e8 32 4f 86 90 12 c0 54 8f f5 7e 6d 6a 9a 69 21 1a d2 61 75 42 ac 71 ed ed 88 df 95 c2 da ab f4 77 08 a6 16 f6 f8 e4 79 66 4c 14 2e 2e 67 59 d5 5a 15 66 fa 1f 78 6b 1b ab f5 83 fd 41 10 f5 96 a2 3c 2b ae 7a a9 85 6f c0 45 22 5c fb fc 6e 43 58 33 0e 17 24 9f e0 97 cd 48 8c 08 ea 32 01 56 82 e3 39 93 a4 7e 50 31 46 e9 28 34 df 4b 8c e6 ba f4 98 36 12 22 59 35 e8 b7 24 8b 11 6b 36 47 84 79 cf f1 a2 b9 48 15 a5 56 da 6a 91 c0 2d 4a f5 e9 5b 6f 5c 24 b9 86 a0 6e fb 97 dc 55 63 25 bc 68 e7 76 9d fe 3c 1a
                                                                                        Data Ascii: k4]V;Jd2+qcOMwU>c`"Q,I~s$H.j2OT~mji!auBqwyfL..gYZfxkA<+zoE"\nCX3$H2V9~P1F(4K6"Y5$k6GyHVj-J[o\$nUc%hv<
                                                                                        2022-07-25 13:17:43 UTC1410INData Raw: b5 90 6c f0 75 e9 b4 82 dd 08 80 64 6c 79 65 a0 87 4c 84 ac 3f b1 71 f8 8c 9d 22 23 e9 8b 8a 0f 7d 36 c8 6a c1 4b b4 ad 15 c6 b5 f0 4b f3 0d 99 4f 1a 7e e3 d4 1f 67 89 30 ae 3a 02 8a 91 2f 49 a1 d5 e2 cd 31 2e 8d 1d 60 f9 11 02 72 a9 21 22 e8 7e df cf 17 43 20 46 74 2f c8 24 3e 2c 7c fc 2e 4c f3 51 07 ee 41 cd 32 6b dc e4 f8 a6 bc e9 b6 66 9d 60 c8 ff a1 2f 4e bc cc 05 04 66 26 31 d6 6c 89 64 ac 63 07 88 75 a6 db 86 04 d3 d7 e8 99 86 cc 1b 6a 87 40 95 2d 3a d2 6e 00 4d cf 24 a2 28 43 2a de 21 83 ad 90 eb 95 07 99 33 65 20 6d 8f a7 74 2a 15 67 0e f5 a6 3e 5b 27 75 1a b1 5a a8 9c a0 e9 0f 45 75 00 97 fe 1c c9 95 22 02 6a 7c 0e c7 87 af db f3 d2 01 20 0f e9 93 db b6 65 d0 69 bb b0 16 3f b1 d7 b0 8e b7 b6 c8 89 13 92 94 f7 4c 67 a2 3c 6b e3 37 e6 eb 94 8a 1e
                                                                                        Data Ascii: ludlyeL?q"#}6jKKO~g0:/I1.`r!"~C Ft/$>,|.LQA2kf`/Nf&1ldcuj@-:nM$(C*!3e mt*g>['uZEu"j| ei?Lg<k7
                                                                                        2022-07-25 13:17:43 UTC1426INData Raw: 0b ef 9e 37 01 39 5a d6 88 f1 18 e1 46 f8 d8 aa 36 b0 f1 18 ba 17 23 d7 bd ae f6 37 2e a8 e9 79 07 19 97 74 c7 ea 33 95 c7 5b 00 cd a3 7c 12 15 7c 88 b5 f9 8a 85 10 2c 22 a5 c5 14 87 b7 d8 e8 c5 82 a8 3a 34 84 0e d5 dc be da c9 c6 9b 9d fb 02 87 5d c5 4a 6c 6b 38 b8 62 13 dc 39 d7 ca ed c0 38 73 95 8a 69 e3 6c 18 96 a7 4d d0 1e 81 23 8f 57 30 52 df 79 23 00 0a 65 e2 f9 d5 d2 b9 92 a2 21 4a 3b 61 3f ec b9 cd c0 37 3f 88 38 4f 9d ca 99 2d 25 51 35 53 7a 19 ad ea 26 0d de c6 69 f9 a0 2a 9c 4b 20 c5 b9 a5 21 22 6e f1 be b9 0d 91 4a 92 2c 43 14 c9 99 db 70 bc d4 d5 bc ab 04 50 46 ff 38 f3 57 0b 71 67 6d b5 ff d1 b9 34 5e b7 ba 4e e6 73 b6 51 48 8b cc bf ac 32 8f cb 15 dc e6 ea 20 38 9e 41 76 e1 11 e1 4b f0 e3 de 44 76 a3 e0 f8 da 02 a3 37 5a 6a c5 5f dd 09 62
                                                                                        Data Ascii: 79ZF6#7.yt3[||,":4]Jlk8b98silM#W0Ry#e!J;a?7?8O-%Q5Sz&i*K !"nJ,CpPF8Wqgm4^NsQH2 8AvKDv7Zj_b
                                                                                        2022-07-25 13:17:43 UTC1442INData Raw: 82 75 61 3e f7 bc 4b 9e 04 e4 ec 34 42 03 83 45 3a 03 2c 15 13 33 96 74 7d b0 4c 25 de 30 8d 94 9f 3f 48 5b ea af 7a e2 29 58 5a c9 9a 8f e7 2e 57 8d d0 b4 d7 75 98 2a f1 9b ca 3d 14 0a d6 93 08 fc 8a 8a 3f ad c8 56 55 57 b1 2f e4 97 7a a9 7a b8 54 49 13 c6 89 37 dc de 91 af 82 f9 cb 68 a6 66 b8 40 63 f8 4e 09 f5 d2 dd 19 c1 19 56 15 47 3d c5 c0 16 cb c8 54 b0 31 14 09 76 fd 2d d2 fd 34 bb c2 8d 07 5d 30 64 18 9a dd 43 c4 7d b3 e7 a4 f5 1e 7b b8 23 14 f0 52 1f f5 a2 2d 55 55 37 06 d4 47 87 69 1f d6 16 98 0f 1f 85 a8 6f f0 bf 7f 6e bb 34 8c 84 8f 0e e5 b5 25 1c 4f 64 56 b3 eb 09 09 f5 f0 3c eb d7 ec 65 c4 2d b9 17 39 c6 05 0d af 7d a4 9a 18 c6 67 b5 68 ab 6c ac 5d d1 53 1c f4 3e 1a bb e8 ad de 82 a2 68 68 83 16 d6 6e a0 58 62 ba c2 6c ea 6c 56 3d 68 f7 50
                                                                                        Data Ascii: ua>K4BE:,3t}L%0?H[z)XZ.Wu*=?VUW/zzTI7hf@cNVG=T1v-4]0dC}{#R-UU7Gion4%OdV<e-9}ghl]S>hhnXbllV=hP
                                                                                        2022-07-25 13:17:43 UTC1458INData Raw: df 59 96 82 e1 c9 db 25 f1 5f 41 79 53 eb d8 5d f5 73 3a a6 04 1c 55 88 f9 44 d0 d4 65 5a d3 7d 31 4d 4c 1c a9 8b 62 da 0c 5e 41 c0 95 25 20 33 f2 db 7f 1f 7b d8 93 ea 18 9f de 87 f1 ed 13 c3 a5 9c eb 38 04 8d 97 26 71 ac 7e a2 d2 86 c9 35 7e 1c 5d 50 84 6b 2b 1c e5 07 87 16 d9 c5 04 2c 7b 9f c9 16 fb 4e be b4 ef 3b 69 b8 d0 9a 82 70 6c d2 2c d7 3c 4d 42 c6 fe 71 92 91 66 72 28 9e 04 d7 7d 9b ed 26 b6 f9 85 e2 71 67 37 63 14 d2 0d d5 54 4a 8e c9 94 50 c0 10 34 d2 72 eb 9a 1f a2 21 3f dd 6a e4 10 18 25 9c c5 02 02 6e 1f 28 04 9c 23 57 5e 66 d8 f1 69 4a 3a 37 4b 7c a6 93 be 72 b5 b1 7b ef cb 1a aa ee 50 aa 56 b1 38 23 84 2e 0e a8 1f 2b b2 8e 55 db c3 5d bc b0 4c d4 d1 c6 7c 99 33 80 ba 65 a6 55 99 d7 f4 16 d8 0d d8 94 ca 92 ec 94 e0 08 7a 0d e1 8f a1 f4 de
                                                                                        Data Ascii: Y%_AyS]s:UDeZ}1MLb^A% 3{8&q~5~]Pk+,{N;ipl,<MBqfr(}&qg7cTJP4r!?j%n(#W^fiJ:7K|r{PV8#.+U]L|3eUz
                                                                                        2022-07-25 13:17:43 UTC1474INData Raw: cd 54 72 4f 50 26 03 ea d0 22 da 54 1b 7b 18 03 e2 cd d8 28 13 71 20 96 d3 62 3f 53 70 d0 46 b9 af 46 7a 2e 6f 86 f8 04 cf 37 a9 d8 0d f9 6d 29 98 40 97 5a 09 97 6b a4 a8 c1 b0 8f 26 6f 20 32 c6 e4 24 e5 4f 69 6a b1 50 c5 9c c0 4d 51 67 f7 26 70 b2 0f 41 5a 40 a9 a2 c1 24 b3 5a 4f 8c a5 2e 30 2f 08 11 46 7d 3f 5a f8 48 86 6a 5e df 78 23 8c b8 ed 3e d2 87 0c 3e 17 dc 59 ec 2a f7 55 af 61 52 56 25 34 9a 48 0b 88 98 87 c3 79 b8 6f 71 8c a5 ab 1b 8b df fc 67 0b ae 87 9c 67 86 f2 c2 32 89 81 54 78 da 9b 31 10 f4 d5 99 93 06 d6 6b 40 68 03 f9 0d fa 62 9e ef a5 5e a7 60 54 a3 2d 4c 4b 01 4f d3 11 b3 65 ad de a3 29 02 11 17 3f 07 18 5a d4 b9 64 96 45 d3 49 1b 6b c8 e1 29 83 f1 76 12 0b 5d 97 cb 58 0a b1 3a 88 fa a2 47 d2 db af 5b 65 6c 1b 00 b4 ef b7 3a 34 cd 5f
                                                                                        Data Ascii: TrOP&"T{(q b?SpFFz.o7m)@Zk&o 2$OijPMQg&pAZ@$ZO.0/F}?ZHj^x#>>Y*UaRV%4Hyoqgg2Tx1k@hb^`T-LKOe)?ZdEIk)v]X:G[el:4_
                                                                                        2022-07-25 13:17:43 UTC1490INData Raw: 96 53 0b 65 84 dc 01 23 24 a0 74 d6 54 31 ef e6 ea f6 60 43 83 f1 50 18 25 71 bf 91 5e db 01 05 19 29 db 0a 5e db 26 76 7e ed 6a 7d f7 e9 fa 2b 3f 66 5e 75 46 90 44 dd b6 6a a0 34 34 e1 ad a5 fa f0 01 9f 65 ba 11 1f bd 95 ec dd 59 d1 de c0 9f 95 41 77 c0 30 9d 9e 5a 71 6d 88 cb c5 c0 7f 8e 4b 4c db 4b fc 0c be 5e 55 ed 2b bc 99 1d 97 ea c8 60 a9 5a a0 1e 26 bd 14 93 44 33 c1 6f ea 29 ea 81 86 29 1c 4f 45 67 d3 dd 40 87 96 2f a0 b9 90 9b 2e 23 97 06 38 fa 89 dc cf 30 a0 d2 25 1a ed 38 54 b9 58 d4 8e 13 08 c7 b8 d5 f0 99 75 d5 bf 2f d6 a8 bb e8 9a 3b 2f f9 11 4c 8d 11 4a f7 ae a9 8e b7 53 b7 2f e5 b3 a7 f3 95 bc f7 71 f7 96 9a 53 33 eb 05 b9 02 a4 ab e6 82 00 2c 95 c9 5c 93 8f a3 07 33 9d 56 3a de fd 00 cf 57 42 ed 60 69 27 85 fe f6 9b cd 30 ab 6a 28 be b3
                                                                                        Data Ascii: Se#$tT1`CP%q^)^&v~j}+?f^uFDj44eYAw0ZqmKLK^U+`Z&D3o))OEg@/.#80%8TXu/;/LJS/qS3,\3V:WB`i'0j(
                                                                                        2022-07-25 13:17:43 UTC1506INData Raw: 05 1f 30 ac b5 89 6a 2c 09 2b 0e 6b 29 b5 eb 27 18 4d 17 3c 05 6d af cc 95 3e ec f6 99 b8 55 fd 6e eb db 82 f1 6f 24 3f 36 1f fd 8c 67 68 07 33 9c 86 45 13 3a d3 1b a2 26 c2 58 2b 98 33 ce da e3 aa f2 7b 00 24 e2 58 25 9a f6 d0 37 37 0e 87 18 fd 9f c2 18 ef e1 d1 37 ef b1 f3 7c a8 bb 4d a7 d5 fa cc c4 76 6f fe af 6c cd 34 ce 7c b1 87 2b c3 3e 36 6c 70 26 1d 2a b1 2b 47 42 4f 10 8f b7 30 bc d6 71 d0 1c fc 3f c8 f9 95 21 26 ef 7b f8 52 3d 41 67 0b 61 f0 40 96 88 79 bb 38 18 b7 61 92 a2 87 0c d6 5e 95 d3 9d a7 5c 8b 8a 83 72 c1 06 c9 a7 33 75 bc cd 1d 53 a7 06 bc 11 21 48 68 15 b1 d0 62 7e b5 b9 bd a6 d4 41 5e 1e c0 96 2b c0 8f 57 0b 99 88 4e d9 df 1d 0c 34 f6 1e 45 78 c7 01 86 10 0f 1f d1 01 cf 54 9e 60 a5 5f 1c 31 bf db fc fb 95 8a 14 94 6b b8 88 fd 03 c8
                                                                                        Data Ascii: 0j,+k)'M<m>Uno$?6gh3E:&X+3{$X%777|Mvol4|+>6lp&*+GBO0q?!&{R=Aga@y8a^\r3uS!Hhb~A^+WN4ExT`_1k
                                                                                        2022-07-25 13:17:43 UTC1522INData Raw: 41 4c 4e 7e 3c c4 36 fc 38 9b 22 30 56 5b 40 cd 82 43 5b 3c 4a 3f 18 11 18 75 5c 81 e2 b4 f3 e6 15 82 bd bc 5d 31 53 c7 c9 9c 86 af ea ef ba ab 88 fb 4f fa 91 81 40 60 b7 00 cf 42 ac 47 2b 78 79 69 35 5e 77 aa 94 8f 22 07 03 b7 d7 45 29 22 e3 3e c4 a3 4e 5e cb e7 6d 4f 7e c7 bc 95 4e 38 66 ec 54 10 c1 6f fa 33 bf 0e b3 80 76 39 92 b7 fc ca 2d 48 5f ca 22 d8 9c a8 b7 84 b2 ec 14 5a 0e 91 a5 d6 86 9f ff fd 00 91 6e 24 e8 8c 32 7f 16 d3 b1 5c cd 0f 15 4f e9 d2 cf fb e9 f5 2e 0f 6b 5e 89 cd c3 ff f0 1b 78 69 f9 d5 2a 93 3d ef aa 08 75 9d 12 21 22 c6 76 0a 13 da 18 4f 46 31 93 fc e5 c4 14 bd 6d 4f a2 88 5a 88 dd 06 cb d4 ad 22 0d 6c 4c 70 4f b1 fa af e0 8c 14 c8 e3 c5 42 5e 92 13 44 34 60 73 bd e0 ee 46 0d d8 28 78 ed de 62 10 12 bc f0 4d db e3 68 3b 7d 4f 32
                                                                                        Data Ascii: ALN~<68"0V[@C[<J?u\]1SO@`BG+xyi5^w"E)">N^mO~N8fTo3v9-H_"Zn$2\O.k^xi*=u!"vOF1mOZ"lLpOB^D4`sF(xbMh;}O2
                                                                                        2022-07-25 13:17:43 UTC1538INData Raw: 75 d0 25 a4 19 4b 22 29 5a 29 1f 74 d9 e9 3f 0d dd f1 ef f0 c5 3a 29 82 18 e9 32 82 5c 3b 22 15 f3 67 e4 fc 33 88 92 be a4 c8 74 f9 f1 5e 11 3c b1 76 33 a2 af 3b b1 e6 82 6b 0b 32 46 8c f7 25 82 58 a5 b7 6c a5 7e b4 11 ed d7 bd c7 5b 2f 0a 37 0f c0 cf 83 73 71 ff c2 72 5a 30 d0 1e 67 f5 71 66 d0 96 53 4c b5 cd 2f 6d ca 28 8f 7d dc 14 6d 8d 07 e1 43 e7 5b 87 b5 2d 97 36 75 70 a8 27 4e a8 46 ad 99 1a 8b 22 5e 5f 47 d8 9d ca f1 8c 25 59 26 5e c1 4b 9c 51 5e 1a fa cb ec ab 95 05 ed ee 21 e3 3c 13 e3 89 6b ee 8b 7c f5 e4 d1 54 eb 20 1e 54 81 1d 2a ce 5c 8a b2 31 54 7c fc ba 4a 5a 0f d6 d7 30 98 91 8a fc 9b 7d 94 02 84 06 cb b9 cd 01 bc e0 2e c9 df 5c a0 9a 58 71 dc 2a b4 19 66 1b b7 63 3a 6d 9c 7a 54 d0 1b c7 40 4a d7 bb e2 55 d7 4e 7c 75 dd 42 6b 9a 08 8a 43
                                                                                        Data Ascii: u%K")Z)t?:)2\;"g3t^<v3;k2F%Xl~[/7sqrZ0gqfSL/m(}mC[-6up'NF"^_G%Y&^KQ^!<k|T T*\1T|JZ0}.\Xq*fc:mzT@JUN|uBkC
                                                                                        2022-07-25 13:17:43 UTC1554INData Raw: 37 44 70 38 9d 61 69 57 35 5a 91 a5 ab c2 60 59 77 6b aa 13 0f 66 9e 4a 7b 7f 25 d4 76 d1 75 3b a3 b4 01 ed 4a c6 46 ec 33 c7 1a 00 d1 7e 47 99 c7 8d 3e e1 e5 fd 4c 2c 77 35 a9 e8 ea e9 9a f3 91 1f 36 c9 bc a6 d2 05 62 a7 d0 45 a1 78 ab 57 34 e8 7d 9c e5 e1 68 5c de ff 27 1c 1c b3 38 d1 c7 a9 b5 50 30 af e8 70 bd f4 72 e3 43 9e e3 b4 e3 f9 af c1 d6 6d 84 29 35 cd 95 1c 3f 85 53 5e 9b aa 62 d9 2a df 88 09 a3 1b dc 11 22 e2 40 22 e8 e4 09 e5 d6 ee ce b1 89 55 a6 42 31 c6 85 1d fa 5b c7 94 3a a3 df 90 6c 40 b7 67 94 14 5c a0 8a 2f 7f d7 74 bb 00 87 9d ea 12 3b 97 61 b4 5b 1e 61 5f d0 fb bf 68 13 d6 79 b2 d0 ac 84 54 60 72 61 09 c3 a7 a9 35 a4 39 bd 57 90 ac 21 3f 02 55 c2 c4 47 9f 67 8c 09 3c 24 b0 28 12 12 0b 3e 20 4a 74 47 df f7 f5 d7 d9 42 c0 2f 10 ac e1
                                                                                        Data Ascii: 7Dp8aiW5Z`YwkfJ{%vu;JF3~G>L,w56bExW4}h\'8P0prCm)5?S^b*"@"UB1[:l@g\/t;a[a_hyT`ra59W!?UGg<$(> JtGB/
                                                                                        2022-07-25 13:17:43 UTC1570INData Raw: 66 21 76 60 cc c9 e7 66 aa 07 01 01 ae f8 34 47 d3 d2 40 41 22 60 95 09 18 7f 83 d6 36 38 17 f9 01 0f 5b 4e 1a 8d 9a 3a 19 32 07 99 a5 0b b6 a5 3d ae ea 54 4b e2 d6 5d d1 53 b6 30 2a 1c 37 90 2f 19 4c 61 84 c3 71 f9 b7 04 76 25 47 60 94 b2 7a 95 89 1b 23 38 67 b9 54 fd 51 91 b3 b6 8b 00 69 18 7d b9 7c 6b 12 db e3 4f 43 07 35 36 90 07 44 85 3c 34 80 30 ed 22 3b 94 3c 25 8e f1 1f 14 24 e6 90 23 96 3c 35 77 77 c2 2c 95 a6 b4 e2 88 cf a1 36 4c c3 5c 47 bc 43 9a b0 29 c3 54 72 55 f9 12 73 6e d4 69 6c 60 e9 f3 a6 07 16 5e de a6 44 2f 4d 2f 33 3a c2 5f 99 bf ee 22 4f 15 2c 1f 23 16 76 6a 54 b7 b0 6a 4a 69 73 b7 99 4e 82 e9 6f ed c1 70 e9 99 ce 47 50 e2 17 4d bd ba 61 69 a7 ec 84 0f 46 1b 23 0d 38 12 e7 26 08 94 34 19 99 71 d4 26 fa e6 d5 de 25 03 db 08 d5 04 e6
                                                                                        Data Ascii: f!v`f4G@A"`68[N:2=TK]S0*7/Laqv%G`z#8gTQi}|kOC56D<40";<%$#<5ww,6L\GC)TrUsnil`^D/M/3:_"O,#vjTjJisNopGPMaiF#8&4q&%
                                                                                        2022-07-25 13:17:43 UTC1586INData Raw: c9 c0 70 64 0b 7b e2 14 b4 cf 30 3a 27 f8 67 cd 62 91 40 0f f5 36 46 b0 03 af ce e0 38 38 cf 27 fd 89 e9 ac 7b 7e 6d 9b 47 8e b3 c8 47 5e cf 8f f6 0a ee 28 5e 7d 1f 15 0d 08 c1 fa 6a 42 53 3e 4e 80 71 59 42 df c0 66 48 a3 fb 26 31 64 2a e1 f9 b8 df 5d b8 66 53 d0 aa 13 70 fc 31 fe 47 fd c2 f5 a4 8b ce c3 53 30 29 74 1e 79 b4 d9 8d d4 d6 89 b4 4c 64 fd 8e 0e 7d dd 34 d3 c3 2c 59 da fb 7a 6c 45 f5 a2 df 5a 12 8d 2f 58 0d ab 04 68 be b9 2d e2 37 98 4e d3 6f 12 e2 81 8c 48 6f 73 db da eb 46 de 0c da 01 0f 51 94 cf 1a ef 1b d1 ad be a6 ab c2 5e d7 2c 24 0d f4 fc 18 66 c7 a6 33 19 c9 62 27 72 ea cf 0c 57 d1 bc 66 be fa 51 1d a3 15 f8 73 5c fe a2 e6 0b 32 14 c5 93 12 f0 c8 28 02 00 5a c0 a9 0c 66 c2 7c 41 af af 44 dc fb 1b 2d 7c 84 24 33 3a 0b b4 e6 85 e1 52 b0
                                                                                        Data Ascii: pd{0:'gb@6F88'{~mGG^(^}jBS>NqYBfH&1d*]fSp1GS0)tyLd}4,YzlEZ/Xh-7NoHosFQ^,$f3b'rWfQs\2(Zf|AD-|$3:R
                                                                                        2022-07-25 13:17:43 UTC1602INData Raw: a8 73 99 f9 28 c3 76 87 fb d4 5e 94 e9 b7 6a 71 37 12 82 7b 2c 25 f3 1a 27 3a 6b 2c a2 f6 5f dd 94 69 df e4 6b 02 c6 ea d7 9a ef 48 9d 50 50 1d 81 03 4d a1 76 35 9d af 89 fb de 2f 4f ed 97 c3 1f 93 55 f9 a7 fa c4 3c a4 0d c9 cb d0 c9 56 1c af 0d 32 ca 4b af 78 1b 9b 73 1b ff 69 3b a7 ff a9 60 e3 b4 61 f6 08 ae c3 5c 90 c1 0f a8 6a 73 da 0e 13 7c 1c 21 45 08 2d bb a7 55 52 c5 0a 2e 7a 3c ef 45 c9 48 f9 ab e2 ba aa 34 39 7c 86 fd 9e 44 04 32 b9 ec 05 8f a7 fa fd 3e 69 6f 73 fe 74 76 4a 04 d0 ea 08 17 e7 07 e5 80 01 c5 cf 42 f1 af df 6d e2 3e cc 64 46 0e 68 2d 06 2f 05 51 32 15 48 7b 24 39 2e 48 60 96 b6 e9 ac 10 76 64 9b 94 7b e4 16 c6 72 70 16 3f e1 b2 da f8 07 72 f6 44 dc 81 0d e7 5f 3c 49 07 1a 26 fd c7 ed 94 b0 e3 41 be 49 e3 58 95 ec a4 30 2a cf a4 09
                                                                                        Data Ascii: s(v^jq7{,%':k,_ikHPPMv5/OU<V2Kxsi;`a\js|!E-UR.z<EH49|D2>iostvJBm>dFh-/Q2H{$9.H`vd{rp?rD_<I&AIX0*
                                                                                        2022-07-25 13:17:43 UTC1618INData Raw: 5e 7d d1 3f 9a 8e 0b ab 6e 63 10 d3 d9 2a 29 26 02 42 80 64 48 df 01 9b 47 2a fb 3f d9 6b 2f ca af 6e 82 ae dc 77 12 32 ad bc eb b2 cd 67 2c fa cd 4e a4 7f 52 70 b6 9c 83 18 77 96 76 47 01 43 dc 26 6d cc 55 48 76 f4 4e a8 5a 56 84 7f cc 55 f2 1e fe 30 77 1e 1d 86 ce fb ae 80 e7 ea ac 8e 6a 61 55 d3 96 57 53 ae f4 dc 04 8d 2e e3 34 6d d6 55 a6 7b c5 1e 3e 0c d2 d6 b3 9c ef ca 22 91 87 29 66 b0 46 b8 7a af 39 7d 4d b2 9d 77 81 7a 96 ec ee 85 c2 74 65 a9 0d ec 9e b8 0e d8 72 a1 23 63 2f 6b 32 7b 35 6d a8 36 0f b3 88 00 f3 3c f3 d4 57 40 b8 a0 f8 31 cd 8e 09 a6 d2 e5 60 fe 1c ed d9 b5 ad e2 b5 ad dc a1 26 83 33 38 11 64 39 04 8c aa 23 b3 a6 b9 97 11 9f 78 d9 01 b8 ee 7b 2c 21 78 d9 5a 88 d8 ff 20 55 fd b0 97 e6 55 c5 53 8b 3e f6 60 a7 e7 de e0 80 e4 36 c5 98
                                                                                        Data Ascii: ^}?nc*)&BdHG*?k/nw2g,NRpwvGC&mUHvNZVU0wjaUWS.4mU{>")fFz9}Mwzter#c/k2{5m6<W@1`&38d9#x{,!xZ UUS>`6
                                                                                        2022-07-25 13:17:43 UTC1634INData Raw: b5 68 08 0a 33 7b 31 95 05 26 04 29 9f 9c 3f 85 f9 1c 3e 39 6a e8 ff 5d 11 b7 d9 45 fb 44 e5 7d 1b 4b c9 4d 1b 27 d1 34 db 42 b8 de 27 33 9c 4a e8 28 98 9b 87 50 49 be 8c ca 05 fa 47 8a e2 41 87 c0 71 5c 87 6c 1b 75 99 e5 e4 56 34 9f 54 ba 79 00 34 4d 37 32 a2 8c 2c d1 e5 6e 07 0e 1e f9 6c 36 08 11 8e 91 16 99 2e dd e4 a9 1b fe 1c 25 11 82 01 9c cb c7 1c 3f 9f 83 f3 79 d9 71 82 f9 93 38 1c f1 c7 1d f8 78 d2 b1 4b 2b 4d 7e 5c f3 ad 72 31 ad 5b e6 0f 52 77 e2 dd 48 08 9e de 8e 42 e4 e5 32 6c bf ec af 87 d6 8d 38 74 af a3 02 52 04 e1 32 ca 5f 29 77 75 2f 40 57 4c 65 a1 00 af f1 3e 19 f7 34 f7 cd 7c ac 0d 4f a8 4b 63 2d 05 58 c1 50 2d 16 68 54 c2 c0 d0 0a 30 60 3d 59 ca 25 e1 9a c0 be 78 7c 59 d4 f7 65 41 08 c2 b1 01 11 b8 91 e6 b8 49 4c b6 b6 c4 1b 47 7c 99
                                                                                        Data Ascii: h3{1&)?>9j]ED}KM'4B'3J(PIGAq\luV4Ty4M72,nl6.%?yq8xK+M~\r1[RwHB2l8tR2_)wu/@WLe>4|OKc-XP-hT0`=Y%x|YeAILG|
                                                                                        2022-07-25 13:17:43 UTC1650INData Raw: 38 d6 f6 89 14 de 27 06 f7 b0 ff f8 11 a2 7a 60 c1 e6 13 1a 9f 1d 8e 62 8b 9a 24 ad 03 ca b0 ee 39 f9 df 8a 41 d4 b3 0a cb 7f 57 7f ee 1e ae 77 52 3b b5 97 61 77 65 79 e0 f1 ed d4 ff 99 47 b9 01 4f 32 33 8b 13 64 f4 cc bb 13 8f e2 0a 17 68 a7 f5 e9 d1 3b 24 48 7c 69 28 8f 99 fa fe 42 26 63 80 b1 ce 42 99 5b 27 a3 79 81 b3 70 e5 e5 08 e9 e4 03 e8 7d 4b 29 1f 77 58 9c 10 4d 76 e0 a2 63 48 e2 a5 d8 b0 d2 84 bd 6d ff fe de 0b b3 ba e6 67 ce 9e ce 2e 44 2e f7 48 02 9c 10 c8 00 58 c7 61 21 82 62 0e da 6b 30 5d 96 46 0c 2d e6 36 fa 4c 88 5a 22 7c 4a d0 25 82 5c 71 ac 29 54 ff f6 01 db 99 65 dd 64 e4 47 43 69 98 f6 4b 95 56 8d d9 ba fa 68 88 81 05 2e a7 66 e5 40 4d d6 58 68 c5 a1 30 9b 37 ec ac 3b e9 26 eb 05 62 95 52 ab da 57 bd 52 f3 1e c2 8e f8 e1 cf fa cf 26
                                                                                        Data Ascii: 8'z`b$9AWwR;aweyGO23dh;$H|i(B&cB['yp}K)wXMvcHmg.D.HXa!bk0]F-6LZ"|J%\q)TedGCiKVh.f@MXh07;&bRWR&
                                                                                        2022-07-25 13:17:43 UTC1666INData Raw: 94 1f eb cc c3 28 83 80 51 21 74 fe 63 18 70 23 72 6f f8 ed e3 cd e8 69 ed 21 bc db 48 96 00 20 8e ef 6b b1 4a 65 93 64 47 17 11 75 8b 27 80 b0 d5 c5 29 5b 70 01 8f 72 5a d4 f9 1b 72 f3 93 d7 98 92 57 5c d1 2f de 10 9e e6 98 62 2e ff 6b ec fe 51 2a 7b 0f 87 77 25 28 38 08 f2 3f 6d 68 6e 3a 10 03 87 f8 2c 5a ad 12 bc 46 5b 0f e2 c9 42 04 1e ed b8 30 bc ed 35 77 5b e1 28 c6 90 f2 b3 75 f7 7e eb 30 1e 77 5f 03 93 01 fd 56 81 0b bf e2 30 f7 5b 86 d8 86 bd 2d 48 33 01 31 31 31 e7 45 0e e7 0d fa f0 dd 99 8a c2 3d 22 d9 1e b3 90 7e a7 1a ae f5 dc d8 27 d6 e8 65 d4 47 c1 54 8a 9b 46 b5 e3 9c 57 9b 8d ea 1d ef ca ab d5 00 0e 8e 5d f9 63 2d 19 9d 1e b9 78 36 17 c0 1c 7f f7 56 cf 45 ca fd a2 7f a7 cb ce 02 8a 32 07 d7 a9 58 27 d0 13 87 fb 08 58 cf 98 b2 88 2e 70 05
                                                                                        Data Ascii: (Q!tcp#roi!H kJedGu')[prZrW\/b.kQ*{w%(8?mhn:,ZF[B05w[(u~0w_V0[-H3111E="~'eGTFW]c-x6VE2X'X.p
                                                                                        2022-07-25 13:17:43 UTC1682INData Raw: 54 1c 55 2c e2 40 83 8a e2 c1 d9 7f 5e 72 d4 7c a1 5e 58 7b 7d b2 4d f5 65 8d 1f 15 62 0f 1e cf ea d4 f9 25 d7 91 6f 2d 13 f1 ae 19 c0 b5 07 3d 9d 90 b1 90 54 00 de e3 3c 41 a8 6c 4a aa 6d 35 11 f8 71 71 d5 0b e7 8c d2 f0 58 31 5b 60 56 b7 29 09 f7 83 a8 88 64 f4 80 12 48 54 c5 06 79 83 8b 27 be 5b 35 74 b4 12 8e 38 f9 e4 d4 75 14 00 f4 64 46 b1 da af ff c0 ad e3 b2 40 37 86 e3 57 0d 39 88 82 00 1f 95 6e 60 93 85 07 87 b4 73 87 91 ae d9 8a 7e 3f d4 7a 2a 93 01 e0 26 28 f7 66 c7 d8 dc 0e d5 45 8b e2 7d ba ba be 66 57 5c b7 0b 4a 50 e6 ee c4 7a 31 5c 84 3e af 5a 29 66 1a 31 6b c3 cc db 15 7f 0a 91 1c b5 6a 3a 83 e2 08 88 e4 4b 50 9b 25 46 75 8f c5 f0 03 c7 06 d1 02 e0 4c 56 fc 10 6b 6c dd db 6c 8c ec 9e ee f5 01 e0 22 26 4a 12 b6 ba 0d e1 d8 4c b6 61 52 24
                                                                                        Data Ascii: TU,@^r|^X{}Meb%o-=T<AlJm5qqX1[`V)dHTy'[5t8udF@7W9n`s~?z*&(fE}fW\JPz1\>Z)f1kj:KP%FuLVkll"&JLaR$
                                                                                        2022-07-25 13:17:43 UTC1698INData Raw: 41 d7 cf 24 fb 10 08 7e f2 94 6c 04 3e 5c f4 2f 78 e8 df 08 20 d3 af fa 07 ee 3b 90 07 53 af 22 13 f8 18 74 50 55 2e ef 5f cf 5e cd 6c 44 05 43 4a 30 fe e5 0b 67 ba dd ee 9c ff 08 52 bb eb da 6f d0 c3 7c fb e3 a0 02 27 22 1a ba 67 af 93 d5 33 03 c3 c4 d8 be 09 5a f0 5c 64 b1 8c 17 36 f7 c9 52 13 b4 48 cb c6 ff f7 5c c8 b4 8f 53 d8 11 70 fa b4 60 c8 40 f2 78 c3 43 fa 9b 83 d3 2e 5a 25 c3 ae 94 83 d0 a9 9c 50 45 42 c0 f2 03 0e be b5 f4 c1 df 1b f7 af 5d 13 ce 9c fc c4 99 2f ed a3 51 51 a3 d9 54 69 3f 87 33 14 8e 4e 7b e1 b5 c5 24 5a 60 e5 b1 b0 f6 02 56 02 d7 c5 7e 32 3b 88 b7 f8 f7 9f 8b 52 66 00 13 a0 32 63 83 d1 dd 58 73 40 32 e1 78 70 49 9b 7a ce db cd d5 1a bc 28 98 79 f8 fe 1c d1 4c 37 bb ff 13 ff 3c 40 d0 c6 af 79 e8 68 ed cb 56 89 c2 53 4f 5f 08 f0
                                                                                        Data Ascii: A$~l>\/x ;S"tPU._^lDCJ0gRo|'"g3Z\d6RH\Sp`@xC.Z%PEB]/QQTi?3N{$Z`V~2;Rf2cXs@2xpIz(yL7<@yhVSO_
                                                                                        2022-07-25 13:17:43 UTC1714INData Raw: c5 83 2e f6 c4 a9 c8 f5 5d db ec 83 d7 93 08 a1 27 23 ad 2c 68 98 72 2d 93 f5 e5 56 1e e1 18 8a 77 fd 66 63 7a 80 87 39 17 30 22 65 b6 9a 59 9d c0 29 41 58 30 87 5d 83 c8 31 40 1a eb 20 fb 11 0d f0 50 2b 0c b4 1e eb e5 01 34 1a 92 7b 71 43 c8 0c 7e 66 08 43 83 57 b8 12 f3 08 5b be f4 aa 8f de a4 38 d1 35 d2 d0 22 f2 fd a0 30 60 ef 42 88 dc 98 90 21 e0 f3 34 2a 6f ea 51 e0 53 f7 bb 0b 71 00 d9 c3 0f dc e2 96 cd ca 50 d3 85 6a f2 94 16 f6 02 6c 7f 9b 75 ef 12 46 85 7c 70 4b bd e5 57 60 cc 68 12 99 ca 0a 5f 7d 8f a5 09 5c b5 42 91 7b 53 05 ec 8e 75 7e f7 67 e3 93 15 c2 23 f2 63 01 34 76 dc b8 40 64 98 41 3c 45 f4 f1 12 b0 cb b0 3e e6 3a 19 9c bf e5 a1 54 1c 9a 82 cf 27 3c 92 67 69 2a 59 89 ae 16 3d bc 99 a9 82 f8 a6 12 bd e8 a3 28 51 39 46 37 9a d1 1c ba 3b
                                                                                        Data Ascii: .]'#,hr-Vwfcz90"eY)AX0]1@ P+4{qC~fCW[85"0`B!4*oQSqPjluF|pKW`h_}\B{Su~g#c4v@dA<E>:T'<gi*Y=(Q9F7;
                                                                                        2022-07-25 13:17:43 UTC1730INData Raw: 2a f8 e2 22 a4 f5 35 9e 54 2a 25 3a 77 04 ac 39 2d 24 ed 30 00 c8 2f 87 c1 78 10 f9 76 cd c0 c0 8d 2c df 10 ad b8 19 87 60 20 06 c6 59 77 de 08 0c 79 cc 83 c3 bf 52 bf f7 5a 84 29 8a 68 0a 41 0e 62 b0 3f 8e 1c 4e 6f 7b c9 16 34 0b 1b 05 10 24 07 09 99 c4 20 3a 12 d3 0b 02 a9 19 df b1 ed fd 9b 1a c3 54 03 67 65 44 4d 35 0a 54 6a 9c 5d 36 45 e8 39 62 5b 0a 8b 35 8a 04 38 02 aa 5a 1d 0f 31 32 18 8e 80 9e 8e 93 4f ff b8 95 ca 3b d0 d6 78 9b 90 fe e3 70 77 27 a2 ac 68 e8 02 2a 09 78 08 39 ec bc 87 62 06 93 f3 fb 30 e0 c5 17 a6 20 49 7b de 7c 57 11 b6 0b 0f a9 09 40 8e f8 53 a5 78 63 6b a6 41 f3 2f 13 45 ef e1 f2 21 0a b8 07 07 61 35 79 f2 2f 06 c0 e5 5b 6a ee 07 68 41 ca 59 09 30 9a 43 3f 46 50 90 ad f7 a4 ce e2 6b 0f 03 57 3e 22 cf 64 d7 e1 25 7e 7b 1a b0 52
                                                                                        Data Ascii: *"5T*%:w9-$0/xv,` YwyRZ)hAb?No{4$ :TgeDM5Tj]6E9b[58Z12O;xpw'h*x9b0 I{|W@SxckA/E!a5y/[jhAY0C?FPkW>"d%~{R
                                                                                        2022-07-25 13:17:43 UTC1746INData Raw: 1b 52 f1 eb ce af f5 a6 77 27 16 8c 8c 2a 44 88 7e 15 6c 63 64 42 4f a3 7b 0d 7f a4 37 72 f1 31 9b d1 80 c5 39 2f 96 03 34 d2 c2 ea 6b 00 67 9f 5e d0 1e 90 39 32 30 31 75 ea cc 84 14 12 62 13 2c fe 3d e5 8d 35 a0 b0 13 b7 fa ca 65 00 7c 59 69 74 62 84 7d b0 1b 5b e6 0e 21 62 9c 90 89 f6 b1 bb df cf 9f 77 1f 58 c0 96 27 66 a6 6a fe 6a 6f 1a 33 bf 16 a8 c9 2e 76 6c 96 df 17 82 fa 66 f7 ba 77 a6 19 84 63 26 18 83 1e 7c 64 53 4a 83 ce ca 31 90 5c 38 68 80 4c 2d 7e 2c ab 2e d9 a9 e4 35 9c 70 e1 60 38 77 14 a5 e1 be be fd a3 fa b5 04 d7 11 1b 43 cc f7 d9 ef 99 5a fc 10 2b 0d 06 bd 33 ed 48 4d 28 27 26 bc 0b a6 16 1c c3 26 f1 55 59 8d d0 ab e0 76 6d fe 46 39 7a 71 8c 58 a6 d5 20 4e 80 9c 24 63 42 b9 b0 af e8 5d eb 55 a4 50 db c0 36 67 49 bb 7e 10 0b 47 0d 3c 28
                                                                                        Data Ascii: Rw'*D~lcdBO{7r19/4kg^9201ub,=5e|Yitb}[!bwX'fjjo3.vlfwc&|dSJ1\8hL-~,.5p`8wCZ+3HM('&&UYvmF9zqX N$cB]UP6gI~G<(
                                                                                        2022-07-25 13:17:43 UTC1762INData Raw: 45 08 fd 75 79 13 d0 1d 5b 7c a4 dd bc 6e 74 1a 99 05 03 62 61 b2 3f ed 65 fa 1b 4d cb 18 21 b2 14 3c eb e6 d6 c8 a8 6e 2f 05 7f fa 8e 62 d0 25 12 f3 5b 3e 0f fb 82 b1 cc 54 7a df 5d be 03 5a c0 5c 5d a2 c8 34 7d 18 4f 33 05 bd 39 0c 15 47 24 70 53 84 7a 72 c4 c4 8c aa d0 da ba 59 71 6d ba 88 8a 97 35 73 2f a7 92 fc 0e a7 64 f4 65 37 c6 67 a9 b7 1e 47 5b 75 da ec ab 6e c5 e1 2c fd 8b 39 14 a6 26 65 52 35 8a a0 43 af 52 41 18 1e c5 f1 b5 b5 bb d1 cd 8a ad 00 a5 0d a6 a8 19 3c 34 cb 05 04 3f cf fa 11 4e b9 58 b6 fd 79 b3 49 4c 53 96 7a 70 a0 cb e9 d9 f3 f1 c7 ae 52 78 07 25 a7 0f d4 88 39 e3 1c 69 be 1e 94 1b 05 63 9c df d5 82 02 9d bb 5a d6 91 b4 00 df 78 91 7f 7f 3e 4c 14 8a 02 39 11 86 48 b1 6c b7 24 57 f3 0c 17 b6 dc cf 0d 27 7e bd 43 68 32 61 de f5 08
                                                                                        Data Ascii: Euy[|ntba?eM!<n/b%[>Tz]Z\]4}O39G$pSzrYqm5s/de7gG[un,9&eR5CRA<4?NXyILSzpRx%9icZx>L9Hl$W'~Ch2a
                                                                                        2022-07-25 13:17:43 UTC1778INData Raw: 38 c2 b3 bd e8 14 16 c6 65 61 66 37 b1 2a 11 2c 16 46 2a a4 35 fb 98 7f 33 91 bc 61 a0 0c b9 6c 61 2d 8b 64 15 3d 0f 8c 03 ca 4f 0e 96 14 c3 27 2f d7 2a 77 d6 fc 0b c8 16 d7 89 36 d3 87 ee c1 6f 53 ec 24 a7 d2 20 95 11 8f 54 12 02 86 d6 b4 7e b9 e5 f8 62 68 e9 40 61 5d 3d 35 16 62 78 ba 6d fa 80 5f 5f fd 70 a3 72 36 df 05 d9 f0 14 df 71 4d d1 cd cb a6 56 78 2e ae 28 59 71 54 da ab 4d d9 ee 5f 7c f9 7c 8c b1 3f 91 ba fc 90 cd 4c 14 16 05 2a f4 a8 6e 18 2b 9e 26 c7 12 6f 65 f3 98 8b da 40 ee 7f 24 3d 1a 3a 14 5f 6c 7b 55 c7 e4 5d 14 32 63 0e 42 f3 55 a2 97 d2 62 23 6c f2 a9 30 80 eb e6 00 32 82 e7 25 6f c5 f0 92 86 c8 40 82 c0 f0 cd 45 b3 3d e9 3a 75 32 21 02 a1 25 f5 4f 52 47 7a 72 01 a5 2e b6 94 36 e8 24 b3 55 c3 67 65 07 f4 8e 85 bc 80 f4 a4 c1 b9 b9 1f
                                                                                        Data Ascii: 8eaf7*,F*53ala-d=O'/*w6oS$ T~bh@a]=5bxm__pr6qMVx.(YqTM_||?L*n+&oe@$=:_l{U]2cBUb#l02%o@E=:u2!%ORGzr.6$Uge
                                                                                        2022-07-25 13:17:43 UTC1794INData Raw: ac 26 76 1a 7c 69 dd e9 3e aa 82 90 04 39 b6 b5 7e 45 e6 95 e0 8d 2d 9a cd 8b e2 61 d0 3c f3 d0 11 0c 4b f7 86 bc 29 74 5f 67 11 e4 78 8a 78 67 93 41 5d 29 4a 43 40 58 a4 fe b7 dd 33 03 45 06 79 0c 6f 3e a3 c0 39 e5 dc 0d 8d c7 49 a0 f4 d9 dc b3 b1 7f c3 e3 c6 6d 7f 52 3d 05 07 dd bf ba 7d da 05 20 43 3a e0 07 44 a0 32 6c 97 a1 aa 51 a1 91 ff ef 78 b9 8a 11 db 5c 75 c2 09 d4 b5 ba 7a e2 a9 f2 13 53 4a b1 ff 21 60 e5 ab df 39 79 cf b4 f7 be c8 06 eb e7 57 3a dc f4 6e 9b 99 33 aa a4 dc c3 27 bf d8 89 ea 33 bd 54 fd 9b 0e b3 f7 a0 ae 3e 21 02 a1 87 83 c5 fe b1 45 1c d1 c6 83 01 bb 81 6f 73 29 2c 21 45 07 67 2d 81 ab b7 ae 15 f3 e6 82 95 11 42 fa 29 44 66 90 93 27 21 85 29 2c ba 15 1c 90 07 1a 49 1f 8f 7c 90 83 a6 ee 6a e2 71 7a b8 5e 48 61 2a 13 99 2d 61 34
                                                                                        Data Ascii: &v|i>9~E-a<K)t_gxxgA])JC@X3Eyo>9ImR=} C:D2lQx\uzSJ!`9yW:n3'3T>!Eos),!Eg-B)Df'!),I|jqz^Ha*-a4
                                                                                        2022-07-25 13:17:43 UTC1810INData Raw: 31 2f f1 6d 3a 98 a7 9b 93 9c 9c d1 6d a5 a7 5f 59 2a b3 28 56 b0 5a aa b6 27 dc e4 6a 7d 02 66 47 cb e2 99 b4 4f a2 16 be fd d7 df ef 07 ee 64 3a b0 49 34 b0 d6 c8 f4 93 a0 a0 eb 4e 28 e9 fd e7 8a cc c3 07 41 d9 24 1d 0e d0 b3 8d 0b 45 18 9f bb 10 f6 c7 2b 14 89 81 09 cc 5f 83 0c 07 fc 5c 3a 30 6e d0 54 ee 07 c5 55 16 02 9a 19 cb 8e 27 e1 72 6d 87 f1 c2 4c df a3 e3 a5 e9 73 d1 8f 3e 3d 94 7d 65 67 5a cf 40 55 c1 a4 0f 65 8e 32 12 58 ff c5 a3 a8 34 d4 18 d6 23 71 55 e0 b4 8c 96 ac fa 9e c7 f4 a9 72 83 ca 46 5e c6 ea a4 30 ad 5e c8 8a 0f 71 5a 8c d2 eb 73 57 56 f1 45 33 41 43 47 57 4e 68 02 20 4e 3d 08 98 aa de 7a f1 43 6a 56 25 8d 25 1e 88 dc 59 1d af f1 c7 4c d5 ff e9 10 db 4d 46 09 8d 4b a3 3d 1a 43 69 a7 fd b4 90 29 fb db 2c e3 45 1c 43 7c b3 bf c3 eb
                                                                                        Data Ascii: 1/m:m_Y*(VZ'j}fGOd:I4N(A$E+_\:0nTU'rmLs>=}egZ@Ue2X4#qUrF^0^qZsWVE3ACGWNh N=zCjV%%YLMFK=Ci),EC|
                                                                                        2022-07-25 13:17:43 UTC1826INData Raw: 33 a4 76 16 61 c8 ea 1e 17 fd 4c 95 32 58 9e 2e df 58 e4 12 f3 5d 57 37 fe 32 90 8f be 71 23 ae aa 33 ef fe e6 c9 14 f0 d4 89 27 1c 97 ab c3 ed 43 24 25 0d f5 9a 4a 7e ee ff fb 76 17 ce ac 05 72 58 b9 cb 8d a5 b4 b1 6f 11 12 d7 76 2e bd 25 ef d8 94 a4 d3 c8 e1 10 93 72 ce 9b a0 1b c1 08 40 18 86 6f 89 c3 a4 11 e4 4c 59 8e 8b 62 1a 68 5e fd aa ce 8e aa d9 4a ad 13 14 71 76 ab 7c 38 eb 4c ab 22 97 0a 0c ec a0 ce 79 a1 9b bd 68 70 29 83 b3 74 ff 65 61 bd 06 68 54 a7 6f 70 23 91 93 14 63 8a 84 40 7c 1b 24 c1 9b 70 08 82 37 a4 f9 34 3f 06 76 53 f4 22 25 d3 b1 85 f0 63 da ee a3 5f ad f7 92 7c 9f cd a1 68 2a 36 ae 06 2d a1 df 41 fa 8d e3 51 e6 8b 33 ab 48 06 47 45 b1 02 ff 6b fb a9 29 cd 83 f1 d9 43 84 6f 7a 19 5d 72 36 27 7a 15 05 e5 98 dd 62 3f dd 10 21 61 1d
                                                                                        Data Ascii: 3vaL2X.X]W72q#3'C$%J~vrXov.%r@oLYbh^Jqv|8L"yhp)teahTop#c@|$p74?vS"%c_|h*6-AQ3HGEk)Coz]r6'zb?!a
                                                                                        2022-07-25 13:17:43 UTC1842INData Raw: 77 af b1 8e 71 2e d2 de 2e 9a 0c 1d 5b eb 4a 42 b3 af 31 75 74 c0 71 73 85 95 5c f8 7c d9 00 8f 0f 5d f9 0f 22 00 09 68 89 d3 d0 5a 57 52 47 38 49 16 88 09 4f bb f0 61 9c 02 ab 0e 56 d4 ad 57 61 d3 96 c9 60 7e c8 f8 09 3c 1e 4d c1 a7 ae 01 e1 37 a3 48 89 8a 60 d2 bf 31 88 28 05 59 12 8b 51 92 bc b6 2c c3 a9 61 21 fd ca 1d d4 95 11 3c d2 7c d1 1a 11 fa c5 09 10 54 2b 4a 09 e6 61 63 96 ae 7b 2a e4 16 5a f3 40 15 03 da 67 09 24 eb 2e 9a 46 0f 61 7f ce 32 aa 1c 0f 6f 57 7f 7c 3d aa 92 37 c9 af e1 51 63 ab 3c fe ad f2 7f 96 8c 37 5a 5f 95 5d cd 8c f8 24 ab 40 b7 a5 ca c5 6a 0e 8a fa 84 ca e7 25 e3 8b 04 1a 77 8b 6c 1f db 15 7f 5e e9 17 f8 94 38 ca 4a 18 08 da c1 18 75 ad 62 db 14 32 22 60 98 92 5f e9 c0 fc 03 97 4b 6e f1 3b 2c 53 73 4c b1 82 3b 85 5b 6c 8c d5
                                                                                        Data Ascii: wq..[JB1utqs\|]"hZWRG8IOaVWa`~<M7H`1(YQ,a!<|T+Jac{*Z@g$.Fa2oW|=7Qc<7Z_]$@j%wl^8Jub2"`_Kn;,SsL;[l
                                                                                        2022-07-25 13:17:43 UTC1858INData Raw: db c7 fb 10 2b 08 51 f6 9f fd 3d 26 5b f4 31 05 34 64 8b 21 fe 3d db 7a 75 bf 30 94 f5 c2 bb c2 7f df 29 3e 7c 18 1b 5a 3f d9 8b 41 d1 fa f1 2e 58 e7 12 56 38 58 a2 2f ac 70 c2 33 f7 94 70 ba 81 1e 72 00 3a 1b 7d cf db 3b ec 1a 21 b7 4c 66 f7 76 7b f0 64 0f 6e 6f d9 96 93 47 1d 5f 95 de 77 57 10 35 60 df 1d 14 36 1c 8b 0e 58 12 35 83 bf 11 e8 ec 9d 45 0c cb a9 fc 8a fa 06 72 fd 63 fc 57 01 c5 0d d4 ce 6e 25 27 0b b1 87 d0 1f 28 5a 5a b1 81 cd 7d 33 08 1c d0 87 30 57 4a 9b 7f c0 20 d9 c0 a9 fc c4 e7 f2 86 ba 60 0a 34 ec 16 79 dc 3b e9 b1 d8 00 aa 86 09 84 ce 45 3b 56 36 93 8b 12 b3 ee c2 3b 6b 60 2d 46 9f 04 50 71 42 68 99 87 a4 5c 73 f9 d2 fc 73 2c 79 7d ea 5d e8 18 4b 2e 2d cd d3 ff e0 9a 2a 5c 50 0a 09 bf e4 1b c9 90 3c 1c 1f 89 1e 59 a0 98 f3 66 36 dc
                                                                                        Data Ascii: +Q=&[14d!=zu0)>|Z?A.XV8X/p3pr:};!Lfv{dnoG_wW5`6X5ErcWn%'(ZZ}30WJ `4y;E;V6;k`-FPqBh\ss,y}]K.-*\P<Yf6
                                                                                        2022-07-25 13:17:43 UTC1874INData Raw: 49 e5 50 00 7c 6b c0 2a ba c2 62 98 6f da ba 86 53 3c 51 d8 c1 67 61 db c1 e8 2f 38 1b d1 3d 62 65 f0 e3 c0 3c f5 e9 d2 dc b0 8c d1 cd 0e a1 56 22 bf 6e 57 24 13 57 91 b8 47 75 86 c2 4d 56 3c 47 f2 3e c8 1f 0c b5 56 34 95 f2 e0 ba 32 4f 45 43 31 80 8e e6 e0 be f6 d3 eb dc fe 0d 04 d8 b0 b8 b9 01 06 fd 3a c5 11 9b 39 32 9d 8a 08 47 c4 7b c5 65 28 0a b9 d2 04 fb 31 10 22 cf 7e 39 82 c0 35 1f 66 6c 5e 3a b6 69 47 0f 60 04 7c 07 ef 10 b0 f9 05 66 11 46 a4 0a 96 70 5c fd 9f 75 f6 eb ce 81 45 fb ca e1 a1 a2 92 b5 b8 2a f5 88 8f 1e e0 0b fc 30 79 dd 0a 87 d9 3b 0e 40 83 50 2b 86 64 a9 3b c4 cc b1 4a fc be f4 4b d2 f4 a6 f4 67 b0 51 e7 12 a6 7b ac 09 8e 57 7c 6c 5f 00 47 7c 02 1c 68 ca 3b 63 d4 6e 4e 2b b9 f3 f7 f3 db 9c e9 10 f6 01 5e 01 f0 79 3c ee e8 02 49 5e
                                                                                        Data Ascii: IP|k*boS<Qga/8=be<V"nW$WGuMV<G>V42OEC1:92G{e(1"~95fl^:iG`|fFp\uE*0y;@P+d;JKgQ{W|l_G|h;cnN+^y<I^
                                                                                        2022-07-25 13:17:43 UTC1890INData Raw: bd 70 72 eb 43 7a 9c 86 38 a7 37 cf 7c 7d 36 d8 7b 1e d6 e8 42 77 91 64 12 de 52 85 d1 3f e1 c9 b2 9e 40 ca 15 c9 0b dc 4b d8 49 ff a3 6f 3a 84 5a 3b 8b ee 32 7b f7 c5 46 8d dd 20 f3 1b 08 29 1b 07 05 5f 30 14 ef 4e 9e f2 a2 81 3b bb 1a e9 b7 7c fb 35 11 d6 57 69 99 7a c2 0c e6 ee 82 b5 4c d8 de e4 b0 32 fd 6f 98 a1 94 77 1b cb f3 f5 c7 72 c4 14 30 77 70 96 13 fc 4f 61 7d d4 f2 08 13 71 28 1f 81 57 7c 8b f4 23 77 31 ab 76 8c 21 da 8e 4d 99 e1 a4 cd da 88 03 5b 68 9f 29 8e f7 ec 92 6f ed 42 66 d1 c3 e9 cd b5 ae 73 a0 26 39 ed a3 30 cd 6e 64 c0 59 a1 5d a3 47 40 01 49 4b 87 a4 30 4f 5c 19 89 e4 1a 91 a8 43 11 a4 9a 6b 81 55 49 32 e3 03 f8 97 b1 7f 33 75 d7 f4 00 cb 9e d6 f0 20 a6 32 c9 b9 43 d4 39 ab 24 1e 25 2a 02 ea a1 26 17 59 38 3a 5e 84 a5 19 26 15 6f
                                                                                        Data Ascii: prCz87|}6{BwdR?@KIo:Z;2{F )_0N;|5WizL2owr0wpOa}q(W|#w1v!M[h)oBfs&90ndY]G@IK0O\CkUI23u 2C9$%*&Y8:^&o
                                                                                        2022-07-25 13:17:43 UTC1906INData Raw: ba 3b 64 db 8e 42 a4 49 6a 6d 36 dd 45 da 4c 03 fe 5b 82 c3 25 30 2e 6b 09 3b d3 09 75 51 bf 25 a0 b4 59 05 63 68 2a 85 76 4f 41 5f 26 43 e1 b9 b9 9f 81 42 d8 55 b9 0d db cc 6e 38 00 c2 d1 ca 56 0b e1 41 24 66 87 46 6e 3d 31 c8 0f 05 39 ce 1c 17 d8 5d 08 b8 01 ff 83 db 4c c8 05 b8 b6 96 e9 00 77 3b 94 0d 45 0a 32 de 55 43 27 3a 5e 32 02 f3 8f fb d7 29 01 af b6 be 51 5a 54 cf 5d e4 1e 3c b4 02 87 64 97 b4 9e 8c a1 eb 74 d2 c2 43 34 ed 14 55 36 41 4a 81 b9 e3 86 91 76 e5 a6 36 20 d3 03 37 4a 2f fc 97 d7 5b 24 33 9a f5 27 44 f1 3f 04 e0 42 3e 1d 69 9d 4c cc 76 f2 a6 5f f2 7a 36 d0 6d 43 a6 0f 2d 83 2c 44 62 59 67 a4 e4 ec fb 60 f6 25 7c 06 20 bb f1 1b b1 c2 b2 8a bb 5f ad 91 4d 05 73 41 a9 b9 a3 95 62 70 38 60 1c 7b b3 e1 c8 85 e9 d0 3e 32 0b 37 23 9a e8 2c
                                                                                        Data Ascii: ;dBIjm6EL[%0.k;uQ%Ych*vOA_&CBUn8VA$fFn=19]Lw;E2UC':^2)QZT]<dtC4U6AJv6 7J/[$3'D?B>iLv_z6mC-,DbYg`%| _MsAbp8`{>27#,
                                                                                        2022-07-25 13:17:43 UTC1922INData Raw: 71 6e e7 99 51 07 67 39 2a 46 d8 5c 3c 64 b6 05 61 b2 72 e7 08 03 76 f3 90 5f e7 2e d3 fd 36 12 38 b4 d6 a8 72 0a 52 c2 9e 6b cf 07 e5 46 40 84 3e 6a 36 b9 35 04 8a 05 7a cb a7 92 f1 a6 d3 a9 fe 29 26 e1 79 55 36 21 d3 98 eb d8 38 ec ae 39 9d 58 44 e2 c2 5d e5 d4 7f ea b3 38 6c cd 94 64 e1 fc b6 81 0d 5c b5 28 d2 ae 2f ca c5 cb 81 8c f4 44 9b 18 8e 9f 7a 1e 3f e0 7d ea ac f1 51 f1 a1 d1 d2 43 98 f2 79 14 d9 b4 36 9f 5d 63 8e 98 ad 4b f5 8a 01 55 34 11 df d8 0b c4 a6 b3 32 87 1a f8 71 f8 8b bb ba 37 be f9 0f 20 61 a1 3c e2 86 6c ca 31 2d 3a 12 3a 23 b6 9e eb 3b 15 d7 42 8d 45 59 de a1 ec 99 03 b7 49 3b a6 5a 01 57 2c 5b c6 fe ea 75 64 cc 97 b5 dc a7 62 33 3f bd 25 dd 9f de d4 96 94 82 c2 a9 af 3c 95 97 58 c1 c0 15 6f bd ce f9 32 87 5c 77 2a 49 3b fa 8c f9
                                                                                        Data Ascii: qnQg9*F\<darv_.68rRkF@>j65z)&yU6!89XD]8ld\(/Dz?}QCy6]cKU42q7 a<l1-::#;BEYI;ZW,[udb3?%<Xo2\w*I;
                                                                                        2022-07-25 13:17:43 UTC1938INData Raw: f3 6e 9a 3c 4a 83 f0 ad cd c9 ef a1 55 c1 df 73 b5 6c e6 b5 98 70 31 e3 7f 03 89 15 11 ff 81 1d 99 4a d2 49 b4 d7 6a 99 70 8f de 45 b5 b0 d5 6b 29 f3 a4 d4 cc a2 93 76 bb a4 04 b2 e5 f2 d5 0f e7 8d 5c a9 9f 8e 8b 38 8c 05 28 3a 07 f4 15 de 2a 8e 29 5b af a4 b5 0c a2 7a 8d 5b 3c d1 c8 72 b3 f0 82 f6 4a 64 6c b0 71 54 73 cd 17 fb 3b 4a c1 2a 51 05 23 e1 0c bc 7f bc 80 9c 89 57 60 aa fc df ec dd 52 a3 8e 3a 7e e3 21 23 dc 53 ba c9 b3 25 b7 54 2d 5c dc 3c 15 24 13 73 f3 c9 dd 65 11 f8 c8 8b 08 5a 7e c3 d3 1a 62 33 97 da a3 74 25 93 9f 7e 2a 70 45 ee 63 01 e1 f3 9f 0d d7 d1 49 a9 99 77 40 3e 95 35 19 68 e4 15 c6 11 f0 46 9b 18 d8 6d ec b5 d8 ec 70 71 18 c8 10 9e 35 77 27 92 9d 85 3f c9 8f e5 46 3f 98 78 33 c7 75 cd a8 94 64 63 99 59 0c 6b 79 67 c8 6e 76 e1 fe
                                                                                        Data Ascii: n<JUslp1JIjpEk)v\8(:*)[z[<rJdlqTs;J*Q#W`R:~!#S%T-\<$seZ~b3t%~*pEcIw@>5hFmpq5w'?F?x3udcYkygnv
                                                                                        2022-07-25 13:17:43 UTC1954INData Raw: 43 fa bc 7a e7 a4 21 96 cd 27 2b fd 92 48 cb 0b 07 5f 64 af 46 1c 5a 85 62 ef ee 8e e6 50 05 f8 3c 84 a4 9f 2a 6a 05 f9 8c 86 7f df a1 49 c0 33 eb d0 15 ae 63 a5 9e 42 8f 45 e5 ac 11 e8 19 a4 3d f3 16 f4 d5 22 5d 2e ba 80 99 de c1 ae b4 2b 97 78 46 60 19 60 df b7 aa b2 8f 82 b9 7b ad d4 35 b4 91 4a 7c e6 fd d8 96 ff 72 0a bb d6 41 a2 b5 e8 cb 9c a2 cd cb a3 d7 c2 f4 9f 49 46 a6 3c e8 6f ee 54 16 20 71 a9 0a aa de f2 06 90 65 e9 1b ec 96 c3 43 d5 89 09 1b 09 31 cf 36 96 be 47 33 72 cc 0b 46 7c 42 9a e4 f5 48 3c 4e aa 7d 73 a6 8e 55 85 c1 3f 16 1b 9c 10 4c d6 68 52 dc 19 dd 48 f6 d9 eb cf 37 e0 88 35 b3 a3 ec c8 14 b7 48 af d0 92 3f ce a1 1f e6 29 1d b8 45 c6 33 f5 c4 7b b3 0b 3a fb 43 8f 0e 55 42 52 a6 e7 83 4c 14 70 8b 80 9f cb fb 52 57 ce 9d 2e 58 01 94
                                                                                        Data Ascii: Cz!'+H_dFZbP<*jI3cBE="].+xF``{5J|rAIF<oT qeC16G3rF|BH<N}sU?LhRH75H?)E3{:CUBRLpRW.X
                                                                                        2022-07-25 13:17:43 UTC1970INData Raw: b3 ba 02 7e e2 be 61 6e 78 70 fc 37 b8 68 fd 20 b2 6f bc bd 03 3f 4f b8 3a 4c c9 0d 9c cd 81 26 55 03 52 1b 20 03 c7 70 46 17 ef f9 74 a2 7d e1 ae b3 20 c5 ea 50 46 61 5d 5a 28 c9 3e 02 3f 40 80 b6 09 3f f8 2c 44 2e d0 0b 0e f6 0b 06 49 ed 07 0a 79 14 ce 9c 4c bc 93 7f 96 82 db 92 13 0b 2c 8f 34 b1 0b 29 8c 61 fe d9 03 6d 79 04 e0 53 fd 8d 2f de 3b ad 79 6d 8f fd f0 8b af 9c f3 94 9d 6d 66 46 a2 72 b1 c1 0c e9 70 86 f0 3c e0 a4 3b 4d d2 12 0e e0 81 fc 14 f7 e1 1c b8 54 38 01 20 5f 9e 17 bc 0c 82 74 9a c0 7f 6c c0 88 e7 ae a1 73 27 9e cb bb f0 86 5e 2e 90 c3 82 d0 1c 61 04 96 4b b6 a3 17 c5 17 b9 2c 2f 6c 26 49 05 53 bf f0 72 1c fc 5e 33 4f 56 62 b3 95 70 d4 85 11 fa e6 78 c3 8a b4 03 64 50 0c 5f a1 44 c0 8f c0 ec 43 6d 71 5a a8 d0 04 e0 3d 26 dc 38 f8 bf
                                                                                        Data Ascii: ~anxp7h o?O:L&UR pFt} PFa]Z(>?@?,D.IyL,4)amyS/;ymmfFrp<;MT8 _tls'^.aK,/l&ISr^3OVbpxdP_DCmqZ=&8
                                                                                        2022-07-25 13:17:43 UTC1986INData Raw: a5 c6 b1 71 62 0c 0b 05 04 69 db 8f a9 c3 49 e0 0f 22 d2 0b 29 44 9f 3d 00 84 f0 45 ab 46 28 2a d0 bb 39 44 d1 09 32 db 5d 49 a5 5a d7 37 41 23 3e 6c 17 c4 95 c3 7f 28 12 51 50 ea 7a d1 55 17 89 63 27 54 b1 8d b2 56 12 cc 2b ee 8b f9 3b 4a 77 fc a0 fd e3 c7 18 b8 2c 4d 80 e9 1f b9 1a 88 54 d7 4c a3 89 d1 2b b2 5f ca 53 d5 26 7f 77 34 59 fb 9f 88 fd 94 c6 c7 ee 14 5d 2c 79 a1 e0 1d aa 4e 13 03 e6 5c 58 93 d7 20 f9 2e 1e f3 22 14 de 8b 05 1a f7 af 1e 90 03 2a 3d b4 3c 6c 5f 98 c4 f8 8e 67 eb a5 f7 39 02 1c 14 df fd b9 db 43 0a ef 63 9b 1a 5f 7c 16 ed 69 83 1a 44 4c 2b b4 36 e2 dd f3 7d 92 a2 8e 94 c1 d1 c2 83 aa fc 2b 15 ce e8 bf 26 f0 9d 6a 98 2d 91 f9 22 26 52 e9 86 75 b0 85 db 3b e0 2a d8 91 92 9d c3 42 4c 7a 34 22 66 3d f2 6b 46 6d b3 7b 09 b1 69 9d 15
                                                                                        Data Ascii: qbiI")D=EF(*9D2]IZ7A#>l(QPzUc'TV+;Jw,MTL+_S&w4Y],yN\X ."*=<l_g9Cc_|iDL+6}+&j-"&Ru;*BLz4"f=kFm{i
                                                                                        2022-07-25 13:17:43 UTC2002INData Raw: 39 24 28 1e 4c ae a9 5e d8 89 1f 59 9c 10 f1 0a 6f e3 a2 2b d8 d7 80 57 aa bc 75 21 6f f8 cf 62 2c a6 7b 39 a5 24 0b fa a9 11 7d e0 64 1a 2e 81 b6 7c 90 a2 30 fc dc b3 21 0f 92 3e ad 33 da 7b 70 6d 86 b8 24 16 ee 8e 3d 72 ad 2e 5c 27 02 5a 6d 74 f2 00 b7 0e e2 78 2c c2 1a c1 57 6b ce ce 74 70 d2 25 10 88 8d 4c 5a 2c bb ac ab 1f 52 b9 fb 7b ff e9 c0 7a 85 e4 3d 0c a3 49 3d c4 c0 8c 22 23 73 5f c1 0a 83 32 cc 05 a8 ad f6 4a fd bc 7f 12 85 5c 67 6f 65 61 4f fc 16 ce e1 ee a8 5d fa c5 74 2c 5d f1 ea a4 bb 0b d8 c9 63 b5 9f bf 6a 1f 6d 1c e7 3d 2f d5 a2 36 3a 4b 87 b7 d2 da 58 16 10 59 17 86 bb 54 45 27 68 3f ba 26 7b ae 4d 15 c7 98 57 c2 db 75 ca d9 67 1c f0 47 5f 32 3a 73 37 89 dc 24 04 f2 a2 90 25 53 9b ee e1 6c de b7 4e db 40 c4 43 63 b5 c3 23 9d 41 f3 28
                                                                                        Data Ascii: 9$(L^Yo+Wu!ob,{9$}d.|0!>3{pm$=r.\'Zmtx,Wktp%LZ,R{z=I="#s_2J\goeaO]t,]cjm=/6:KXYTE'h?&{MWugG_2:s7$%SlN@Cc#A(
                                                                                        2022-07-25 13:17:43 UTC2018INData Raw: f0 b6 80 6a a1 d7 b3 dc ec 4c 8a 68 58 68 93 ab c3 d0 bd a7 e7 f8 05 ff d9 2a b8 60 c4 eb 41 2e 67 be d5 95 5f 90 94 5c 86 30 9e 72 0e d4 d7 4d d0 ba da bb 3a 6b 6a 9a 75 ba 1c 73 ea 27 f7 5c f0 66 6b a9 46 ab 0f 16 b8 43 5d 60 66 31 ee 1b 91 31 15 46 c0 13 c8 9a ee 6f 19 f4 8a a6 79 bc 08 78 b6 ff 1a a3 d9 59 d6 df a7 03 a1 b1 5b f4 01 7a 1a 7d fc 77 09 00 2f 84 73 1b 28 e4 c4 d4 85 2f 20 0c c6 06 9b 14 09 85 00 44 9f ad 67 08 0a e2 d8 24 e0 64 57 40 5d e2 d3 df 06 e0 fa 9b ea 80 b0 20 e7 d1 a8 e8 28 af 39 e2 c0 40 d6 10 74 2e 16 f9 5f 63 7e 99 8e a4 b0 1f c9 2d 0e 43 52 5e fd 01 e8 bb 07 ca 22 64 03 d0 ef 77 a3 14 2b e0 22 4f 4d 68 90 23 64 e1 e0 f6 dc 2d a3 22 e7 56 1a 49 d3 0b 43 b8 e6 05 07 13 af 19 b2 d9 ca 15 54 ad 74 58 81 50 86 32 54 76 88 88 ac
                                                                                        Data Ascii: jLhXh*`A.g_\0rM:kjus'\fkFC]`f11FoyxY[z}w/s(/ Dg$dW@] (9@t._c~-CR^"dw+"OMh#d-"VICTtXP2Tv
                                                                                        2022-07-25 13:17:43 UTC2034INData Raw: 5b 99 51 ed 23 45 5d df ec fb 6b cf 87 fa c2 c5 87 8e 77 6f d7 fd 59 83 85 57 84 78 a3 25 e6 e9 8e 3e 9f b4 3a 97 6b ef 57 86 32 0e 5f 7d 14 06 0c e2 ef 1a ec a5 f7 6f a8 51 e6 d9 e3 7b 54 4c ec a8 3a 7a 21 d5 46 16 e6 e6 c8 56 d8 78 a7 37 c6 9c f7 b8 55 ec 70 8d e0 e0 90 d6 fc 72 d5 84 c5 ac 85 8f aa 2c b5 61 56 c4 8f f7 03 4e 71 85 b4 f9 e0 17 ba 2a 46 c6 27 df b3 77 c1 06 23 9f 7e d2 4e a8 98 ce 75 5e 40 12 c1 f9 4d 3d 2b 5a 12 99 ee 92 52 00 46 65 42 46 7b 21 5e e2 e6 7c 67 35 3b 0c bf 76 3b 82 7d 7d 1d 68 3c fd eb bc b0 d8 c1 72 27 dd 38 f6 48 ca 03 dc 48 48 e6 a9 d4 6a d9 7e 33 77 c6 2c ad 9f 9c d8 c4 8d 32 2c 6a 53 0b c0 2a f4 ca 3a 04 87 02 2d 51 54 0e 65 b6 5c 71 32 70 fe f1 3d 33 dd d7 30 1c e3 10 6d 8d 1b 47 3f c3 d9 2b 85 77 a6 29 06 82 bf b0
                                                                                        Data Ascii: [Q#E]kwoYWx%>:kW2_}oQ{TL:z!FVx7Upr,aVNq*F'w#~Nu^@M=+ZRFeBF{!^|g5;v;}}h<r'8HHHj~3w,2,jS*:-QTe\q2p=30mG?+w)
                                                                                        2022-07-25 13:17:43 UTC2050INData Raw: 22 cc 6e 99 e3 53 7a c7 e2 e1 c1 41 c8 b1 70 28 58 02 fc 8e 3e 2a 43 53 f8 f3 b8 f3 f8 e7 08 2a 7a eb c9 de 6d 12 11 e7 4a 11 6f b7 50 00 fe 2a cc 59 da 61 1f ed 2b 70 bf a6 9c 09 5b 6d 6c 31 cf 89 60 9f 46 b6 4e 74 ea 40 bd 94 e3 e5 c5 3a 64 dd e7 d3 9e 78 50 b2 d0 5d da b3 63 5b 54 a9 86 15 fe ff 7d 58 70 dd 17 f2 8e cb 7b 14 8b 6e 97 90 9c 1e 07 28 d8 5e 99 5f b6 ee cc ab d3 0d 3c 8f 2e 25 26 f8 07 ef a5 c0 80 a0 56 61 27 f8 86 e4 3d 76 e9 89 4f 2d 13 c5 df 26 27 39 cd 89 24 a7 17 fe 22 17 48 08 09 bc 79 01 86 bb f3 a2 1f b0 b3 60 87 19 7e 0b ba 99 12 66 3b 1a 5d 89 07 da b0 b8 38 35 a5 bb 21 35 f5 ff 5b 8c 7c 95 fd 7b eb 2a 7c 44 2f 83 4b 64 5e ea 2f b8 df 79 26 30 ad 41 98 bc fd 16 7e 87 c2 f5 5b 39 83 9b 78 57 81 3b 73 6c 5f f8 64 24 4e c1 31 d0 aa
                                                                                        Data Ascii: "nSzAp(X>*CS*zmJoP*Ya+p[ml1`FNt@:dxP]c[T}Xp{n(^_<.%&Va'=vO-&'9$"Hy`~f;]85!5[|{*|D/Kd^/y&0A~[9xW;sl_d$N1
                                                                                        2022-07-25 13:17:43 UTC2066INData Raw: 15 c5 f6 65 4f fe a4 e4 0f 9f 2b 9f 34 62 dc 2e c7 55 aa 78 4e 11 40 ab 3c 85 10 0c 22 c3 35 3d 1f 83 63 57 c9 23 d8 3f 96 2b 08 76 db c6 f1 5a f5 95 87 12 e9 fa bc f7 a6 69 68 74 ff 55 83 78 28 5a 2d cc fd ce de 3d a0 cd f7 0f 12 93 10 1c fe 9c d5 4f 20 24 a3 fd b9 99 f9 c8 ee 8b 7a 71 37 1a 6a 29 b1 ec 49 82 79 ef 2d f0 c6 70 b8 47 56 d8 24 b8 61 47 fa cd 22 05 06 72 24 34 e5 72 fc ce f3 4e 37 22 fc 4a 4a 13 2c 5a 75 db 14 c6 ad 99 00 59 2f f2 29 9b b1 30 0c 0e f9 2a 19 c3 a5 28 38 db 10 ca ac bd 92 82 96 a3 58 97 e2 b5 02 fa 16 6b 65 92 a0 87 82 0c 02 03 22 7d 11 5a 0c 65 59 8a f9 88 9e 2e 17 11 39 fc f5 db 29 b7 dc e7 fa aa 16 30 ed 97 0f a0 41 3b 86 9c 3c 31 d9 be 72 cb d8 b7 18 78 19 74 e6 c4 3c b7 1d 42 34 74 07 ba 3a 99 52 3d d0 de 29 da d7 66 88
                                                                                        Data Ascii: eO+4b.UxN@<"5=cW#?+vZihtUx(Z-=O $zq7j)Iy-pGV$aG"r$4rN7"JJ,ZuY/)0*(8Xke"}ZeY.9)0A;<1rxt<B4t:R=)f
                                                                                        2022-07-25 13:17:43 UTC2082INData Raw: 9c f2 4b 8f 11 64 6f 77 1e 96 00 aa 7a 5b 5d ab f7 3e 24 b9 db 54 c8 3b 9c 9d 4a 74 11 2c 21 75 fc 6e c5 9b 87 96 ab 12 aa c9 7d a4 86 af 36 fd 7f a2 e8 16 d7 27 e1 a7 ac 24 96 25 f1 a7 95 6b 2a 63 4b 8c cf b5 1a f2 02 df 78 90 cf 51 5d b2 2d ff 2b 15 4a fd cb bf b0 30 9e 73 58 df f3 52 36 1d c3 79 51 87 59 b1 74 9d 7c ed c5 39 41 ba 4d 04 46 3a 13 55 6a a7 8c de 78 96 d9 35 e0 66 c2 d6 fa 55 ce bb 9a dc 6a 0f d4 d7 ce c7 82 0c a4 e4 fa 42 20 c3 77 3a 15 be 29 26 c5 ca 7b 8f fd ca 13 db 16 3f 78 5c 7e c6 51 df dc 04 1f c3 1d 4a da 22 12 af 10 03 9a 07 9a e6 49 ce 85 52 be ba 25 ce 19 24 32 09 99 92 88 b7 bf 48 d9 2f dd 89 fd ab 6f af f0 fb 19 61 d6 4f 0b 56 f3 ac 25 6c fc 19 d4 a9 f7 7e 15 f5 a0 0d ec ab 72 0d cb 1d bf 36 ec 08 79 26 36 7b 53 d4 23 f1 e1
                                                                                        Data Ascii: Kdowz[]>$T;Jt,!un}6'$%k*cKxQ]-+J0sXR6yQYt|9AMF:Ujx5fUjB w:)&{?x\~QJ"IR%$2H/oaOV%l~r6y&6{S#
                                                                                        2022-07-25 13:17:43 UTC2098INData Raw: 75 2c 39 3d 82 dc b2 05 83 35 0b 72 5e 81 d5 ea 9d a0 f7 4e 5f 6c 5d 67 71 84 64 71 73 db db 08 28 c0 7e 5a 19 d9 eb 6b 68 a8 f3 95 61 21 db cb e9 3f 5a 8e 9a c2 0c 0d 2f a2 88 57 e3 83 70 a4 67 b3 1b 5a f5 86 7d 99 07 0c 66 a6 81 60 ab 5e c6 74 00 2a ae 2a 4d 71 74 bd bf e7 2c 16 3a c1 01 1a d5 67 4f dd 72 0d 86 77 fc 77 3e c2 d3 a2 3a eb a0 a6 f9 2b a3 8a ca 9d dd fd 8a 28 ff 49 6d 9e 16 ee 87 cb bd 0d 42 93 3f 71 8d 45 b2 34 a0 9e f6 fe 59 4e fe 66 a7 b6 b0 08 1b f6 f6 40 21 42 2c 6b 0f 28 73 37 a8 ef af f6 8d 83 0e 95 bb d4 64 1a 6e ed 68 06 0c fb 99 6b ce 9e f2 7d 4c 45 36 7f 21 84 16 97 48 17 9b 46 7a 33 c2 51 b8 86 35 c9 05 7e 8a 52 17 09 9d 4d 0f f9 57 55 1f 04 52 8a 4a a0 da ba 87 61 da 5f c6 da 81 99 a7 b1 78 4a 4a e1 d5 fa 74 3a 78 81 fa d1 23
                                                                                        Data Ascii: u,9=5r^N_l]gqdqs(~Zkha!?Z/WpgZ}f`^t**Mqt,:gOrww>:+(ImB?qE4YNf@!B,k(s7dnhk}LE6!HFz3Q5~RMWURJa_xJJt:x#
                                                                                        2022-07-25 13:17:43 UTC2114INData Raw: 06 d6 bb 83 2a 01 ed 6c 7d 94 15 cc 7e 4b 98 b7 7a 2f 8d 9f 85 14 d9 4e dd e0 dd 23 d5 af e6 18 a0 16 1e 52 92 e5 ab e7 ba 83 7e 5e bd 51 21 03 7b bd 5e b7 a3 9b 46 ba 3a f8 f6 f0 f3 b0 2c 17 35 a9 dd b9 54 76 b7 61 2c e5 36 11 02 19 e2 7d b8 75 4d e4 57 73 f3 30 07 8d a0 84 79 39 e0 4d ee d8 0e 87 34 d0 be 8d d7 29 5a 91 58 84 c8 fd b4 fa 0d ce bd f0 d1 2f ef bf dd 95 a3 1a b9 2e d0 a1 ba d2 f9 c7 0e ee b7 73 a7 f2 8f 7e c8 cd 02 da 11 74 6c 56 df 1e de 80 9d f0 08 23 07 75 f3 ee 19 4c a6 42 e4 ed 16 82 45 00 8e 1b 76 51 38 8f 5a 11 5a 6e cf 8c 20 74 c8 31 9b 64 31 96 c2 c1 7d 1f ac 19 14 0f 0c 89 50 c9 b0 79 c2 39 34 15 a5 90 41 a1 97 30 04 f3 b5 64 67 75 59 46 39 9b bf 66 7d 81 04 8b 83 97 90 b6 cb 7b 4d 4a 25 b0 de 3e 7e 83 7f 27 65 04 88 fc 68 42 64
                                                                                        Data Ascii: *l}~Kz/N#R~^Q!{^F:,5Tva,6}uMWs0y9M4)ZX/.s~tlV#uLBEvQ8ZZn t1d1}Py94A0dguYF9f}{MJ%>~'ehBd
                                                                                        2022-07-25 13:17:43 UTC2130INData Raw: cb b1 54 0d 97 09 92 ef 49 08 df 56 c5 74 9f f5 fa f5 1f 0b d5 46 2c 9b 37 0e cc d7 6d 02 c6 41 6d 13 67 a9 d6 92 77 b7 fd ac 00 15 49 14 52 74 5b 1d b7 a6 80 22 5f c0 0c 5c 5c fe 8d d8 96 ab c6 77 c7 97 c7 2c 32 ad 6a 0a 8e 99 14 7e 24 e6 4b 14 37 30 07 c3 b3 98 10 61 f7 50 a1 a6 53 92 51 b3 ce 82 b1 7d 81 71 e5 a8 80 7e 58 7a 44 f7 3b d4 e2 b2 25 2e 45 0f 08 44 0a d3 7d aa 11 22 e7 71 a0 f6 7a 2c 3e d9 50 21 a9 7d 4b 71 c4 50 65 6e 2d 3d 48 90 89 89 a1 ea df 28 f2 1c fd 1b 2d 93 76 27 56 12 b6 ff 4c e7 dc 17 cd d8 ae d2 ad d6 a8 eb 27 c0 50 72 a0 d0 ea 1e a4 0f 6f 84 02 70 1c b9 55 82 d8 5a 5e 36 d7 dd 30 49 c0 65 26 18 a0 51 03 5b 5d 95 66 98 24 0d 2e d6 0c 33 ac de 9e 64 ef f3 e7 65 9d 68 12 08 21 f0 6d 93 95 2c 2a ed 21 60 7e b2 e6 39 c6 f6 1f 57 36
                                                                                        Data Ascii: TIVtF,7mAmgwIRt["_\\w,2j~$K70aPSQ}q~XzD;%.ED}"qz,>P!}KqPen-=H(-v'VL'PropUZ^60Ie&Q[]f$.3deh!m,*!`~9W6
                                                                                        2022-07-25 13:17:43 UTC2146INData Raw: 48 49 1c c9 5f 62 dc 27 ef 89 51 2f 81 28 f5 92 2f 96 97 bc 4d 87 ef ce 11 20 4e 4f 5e f5 08 05 87 22 6b 60 79 53 fe 8b 30 bb c6 95 48 0c 5d 8e 70 fe 9c 93 f1 a5 45 4d 8b a2 9d 1a 74 72 e5 2d 79 6d 29 92 64 80 ef 62 59 69 d5 7c 85 ce 85 66 55 e6 a5 12 af 84 84 eb 87 9c 66 ff 2c 68 93 a7 2a 7c bf d9 49 fc f4 f8 67 fa c0 16 63 2e f5 d5 8c ae 18 26 d3 67 33 5c 1c f2 76 24 87 a5 67 93 b9 91 1d cb a6 a9 f5 d9 eb a1 ef 3c 5e 4c 97 11 d5 99 0e a7 f0 09 4f cd 1a ff 5e 7d cf 59 73 7f 93 6e bb 06 b9 39 3d 54 1d 35 8d 8a 71 0f 91 bc 68 76 fa c6 29 87 90 36 13 c2 68 78 37 a0 18 be 86 50 a9 e2 25 6d 3b 76 bc 7b 5b 8d bf 85 4e 4e 7b ff c5 70 65 76 44 e3 cd 06 c1 30 3c d8 14 76 9a 13 1f 89 51 6f 43 6f 2d dd 36 cd 00 ff 5e bb c9 62 11 e2 6b da 9f 6c dd 9c 2a 50 e2 a9 f9
                                                                                        Data Ascii: HI_b'Q/(/M NO^"k`yS0H]pEMtr-ym)dbYi|fUf,h*|Igc.&g3\v$g<^LO^}Ysn9=T5qhv)6hx7P%m;v{[NN{pevD0<vQoCo-6^bkl*P
                                                                                        2022-07-25 13:17:43 UTC2162INData Raw: 8c 7e 71 db f5 76 ce 9f 91 23 93 ab bb 22 a6 c9 3c e3 fb 92 af 83 79 d2 a7 6d cf 63 7e 9f ac bf 58 41 27 06 f2 69 8f e4 03 2e 11 74 38 40 e3 27 4e 99 72 a4 5d 6e 0d ef 85 89 f6 78 c5 64 81 ba ef d4 ba 56 b4 4e 86 be 60 90 51 b5 1a 2b 53 99 f5 65 a2 99 b6 81 76 79 fb 1a bb e4 3a fe 3d a4 32 c4 d8 ac f8 9d a2 ba 57 0e ac ea 9e 66 6f 50 a8 a8 19 e9 e6 8f 01 06 b1 70 54 2e 5c 4b e2 47 9a 59 6a b2 6a e9 49 a3 0d aa 58 b4 a3 74 af ed 1d 28 ed cf 18 4f ab f7 b8 77 e9 4a 4f 86 2a 47 c0 42 22 a7 5e ae fe e9 6e a1 52 e9 46 e6 b0 95 61 63 46 a0 f6 d2 5a 84 92 8a ef 12 d9 2b 93 26 0e 58 d6 c8 6c a4 b8 ab 83 16 ac 6d 80 0c d7 ff 95 a5 33 e2 86 26 41 75 8a a0 f4 64 99 7e 2e 32 9d c2 23 82 c2 bb 2f 44 77 c9 aa 39 45 a4 50 6f fc ff a9 8a b1 3a fd 61 19 5c 6f 51 5f 4d 77
                                                                                        Data Ascii: ~qv#"<ymc~XA'i.t8@'Nr]nxdVN`Q+Sevy:=2WfoPpT.\KGYjjIXt(OwJO*GB"^nRFacFZ+&Xlm3&Aud~.2#/Dw9EPo:a\oQ_Mw
                                                                                        2022-07-25 13:17:43 UTC2178INData Raw: ad 6e ad d6 6b eb 05 66 24 d5 3f 52 14 71 af e5 5e cb 25 2b 90 0a ed 47 9c a4 8e ba 1e 0b ec e0 66 f5 11 85 18 6b d3 1a f8 a7 c6 dc 98 c7 58 cb 4f 56 7e 36 9a 6e 3a 9f 37 a9 fa 25 43 d1 79 8b fa 38 52 98 d4 e1 8c a7 a9 ae 9c b1 a5 1b 47 f9 6e b1 81 2e c2 13 dc e8 a7 0b ae 61 cc a3 64 68 7a 31 85 22 f2 45 bc 3d 1f f1 c5 35 f1 0f 22 3b 6f ee 60 87 91 d1 0f 7f da 38 d7 b2 d8 38 b7 a9 9a 1f 4a aa db 28 9e 05 78 a3 9c 76 4e 97 65 8a 12 1c c5 d7 ed ed 73 10 82 1f 52 1a 56 08 82 e9 37 72 c1 86 7c e5 cc d5 bc 1a 8d 50 89 2a 40 bd 98 86 ac af 4e 92 78 70 40 ba 16 b9 ed f1 37 fb 41 52 e4 5d 74 c6 3e 56 2c 8b eb 4e c2 9d 90 e8 b3 95 be 8a a9 20 71 12 4f 3c 95 01 e7 f7 5b 54 e2 1b 5f 0b b1 93 0b 60 77 6e 2b 3b 44 e6 a7 2b 33 d1 ed 91 d9 96 ee a1 30 40 d6 56 b2 e9 35
                                                                                        Data Ascii: nkf$?Rq^%+GfkXOV~6n:7%Cy8RGn.adhz1"E=5";o`88J(xvNesRV7r|P*@Nxp@7AR]t>V,N qO<[T_`wn+;D+30@V5
                                                                                        2022-07-25 13:17:43 UTC2194INData Raw: 69 2f 3c 79 d8 36 0c b8 93 77 1b fe d9 6c bd 1d 3a 8b f2 b1 6d 83 90 a9 a1 cc d6 a5 a2 5c 22 bd 37 a5 6b de 57 65 d9 2c b1 44 19 98 5e fa da 0d 08 a1 61 4b d1 2e 02 df d0 46 e0 50 5b 59 15 04 aa 4f 54 b7 38 aa c0 cd f6 9b 27 48 b5 bf 35 2e 30 dc 3e aa 8d 0f a5 66 64 a5 bc aa 0c de 8e a8 5b 61 9d a8 2d bb 8d a5 ef 5e ae f4 59 2c 7e 96 5c 0f a4 40 13 80 c4 54 79 30 82 7e 4a 61 eb 40 55 a7 a5 fa 63 d5 14 a9 d9 28 8d ec 05 ab ac 75 cc f6 cf 87 fb 4f 97 84 35 ae 4e e5 25 58 84 54 3b 8b f2 33 61 67 19 18 f0 6a 7c 24 e3 79 c4 11 86 f4 f3 41 26 25 09 2f e6 f4 5d 64 f1 81 d8 f2 aa 09 fe 26 0c 02 48 b5 6f 33 8b 58 92 28 2e fa 9b 6c 9c 2a f3 54 af 3e 0d 44 41 b7 65 dc b6 ed 91 ea fd 8d 2d db 2d c9 af fc a6 6e e5 8d 2b 0c 43 92 61 0c a2 49 61 4f 80 eb 19 41 85 5a bf
                                                                                        Data Ascii: i/<y6wl:m\"7kWe,D^aK.FP[YOT8'H5.0>fd[a-^Y,~\@Ty0~Ja@Uc(uO5N%XT;3agj|$yA&%/]d&Ho3X(.l*T>DAe--n+CaIaOAZ
                                                                                        2022-07-25 13:17:43 UTC2210INData Raw: 6e 59 8f 2f 4f 69 94 30 18 f0 26 cd d7 b7 ed 4b 08 47 ce ea 5b 4d 0c 64 b8 b6 69 66 0f f4 4d 60 9e 4e 12 f4 ff 21 e0 24 48 f8 b9 66 43 7f 49 57 e9 9b d1 1d 5d e7 15 03 e0 12 0b 67 d7 34 d5 07 d2 b5 7c 37 8f ab 00 6d 62 87 73 ad b1 93 78 11 05 0b 16 e1 84 e3 19 36 5e e8 eb ba 4a e8 a9 b6 1a 08 8b 08 fb 8c 14 b7 de b8 25 3a 24 73 09 37 03 6d 9e e8 48 dd 9a b5 09 ca 65 31 2c f1 f2 bd 90 4c b4 76 f5 ad 1d bb a5 00 c5 8b e4 d4 07 0a 00 40 f2 fa 87 59 c3 72 34 c7 7d fe 80 fd f8 ce b9 1f 55 85 cf 02 53 7e 9e fe d3 f1 9a 5a e8 27 b9 d2 87 5c cb 13 0b c1 a7 08 89 51 f1 ba e1 b2 40 95 22 19 3c 72 c1 6e 42 77 67 4f e2 28 1f 0d f7 eb a4 31 70 0f 7f 9b 4c 56 3f 1c fe 45 02 c0 af e0 b5 f6 1d 13 50 8c a5 88 61 72 fc 62 41 bb 41 55 f4 d3 21 a4 b2 70 25 0b f5 93 83 a2 9c
                                                                                        Data Ascii: nY/Oi0&KG[MdifM`N!$HfCIW]g4|7mbsx6^J%:$s7mHe1,Lv@Yr4}US~Z'\Q@"<rnBwgO(1pLV?EParbAAU!p%
                                                                                        2022-07-25 13:17:43 UTC2226INData Raw: c3 1b ad 65 9d 0d 08 1b 7f 1e ec 33 0f 5b a0 ed 71 23 7d ac 71 9d 9b cc a3 97 79 0d 28 14 e1 5f d6 13 53 04 f2 cd eb bd a9 75 cc ba ed 05 35 98 fe 5c 3e 97 77 41 85 25 db 8f 51 6b 8d ce d9 60 27 a9 ec 46 a0 fd 10 a1 17 4a 6a 2d 18 95 35 a1 9d d0 3a b9 32 05 4f 89 fc 38 18 e1 c0 38 fb c9 2d 56 df 55 bc 2d de 5e cb bb 58 9a 3b fc ae f9 49 ac 32 4f ca 19 37 b8 43 38 70 32 05 9a 65 6b 21 c4 5b 5c 42 b5 89 ee b9 a7 c8 c7 37 c5 d6 2b cb d3 33 df 63 22 30 30 23 36 f4 aa 1f 24 78 ae 0d a9 21 4f 3c ae 73 76 f4 96 fc c1 a1 17 61 cf 3b b0 1c 14 27 3a 41 ca f3 07 8a 91 55 89 17 5d 9c 82 59 a0 3e 68 13 94 06 07 2e 0e 92 9a 28 24 41 a3 87 6d a7 ce ce 5d 35 aa 28 45 03 36 38 68 d6 57 01 e1 b6 af 1d 49 0f 85 1c 32 44 04 e8 01 3d fe c1 d0 b7 21 a2 bf 0d 08 58 78 68 d7 82
                                                                                        Data Ascii: e3[q#}qy(_Su5\>wA%Qk`'FJj-5:2O88-VU-^X;I2O7C8p2ek![\B7+3c"00#6$x!O<sva;':AU]Y>h.($Am]5(E68hWI2D=!Xxh
                                                                                        2022-07-25 13:17:43 UTC2242INData Raw: 93 ba b7 13 20 2d 99 92 b3 33 2b 72 f5 6c e3 05 67 eb 34 71 4e d8 68 24 3f c9 b7 13 9c 5f 0d 1a ea a8 24 53 39 aa e9 c2 71 ac 93 cb 18 7f 9d cf 16 cf e0 7d 5b f6 a0 03 df ce 08 3f b6 34 cc f1 26 6f 62 f4 a0 d7 f4 b2 c0 31 5c 8b 8c 1d e0 df cc 41 45 64 51 90 33 73 c4 b5 99 71 86 e5 c3 d3 76 1b 27 48 23 02 68 dc 23 ec 61 7f 1e 67 04 54 ad aa ab db e6 31 77 87 eb 0b 61 2c 70 46 59 56 81 58 cf 18 b2 65 25 80 fc 92 e7 c5 81 7c ad c0 92 a1 25 5b 45 2d f8 ea 0c a3 64 5f 0b 86 dc 19 ec 23 f1 0b 6a 34 12 cc 7b 9f fa 6e 05 fe cd e8 c6 4d 7a 54 1b 87 07 cb 0c 10 c0 37 27 3e c2 e9 e6 a3 dc dd a4 f0 da f7 4f 67 03 fa c5 c3 1c c5 51 23 ff cb 02 ba 01 8a 61 27 f2 f3 0f 91 a5 e8 d3 af 5d d9 cc 82 b6 36 1c bf 6a 0e 8a 4c 16 18 5d c5 63 e8 ec 89 cf ef 56 fe 30 6c f8 30 41
                                                                                        Data Ascii: -3+rlg4qNh$?_$S9q}[?4&ob1\AEdQ3sqv'H#h#agT1wa,pFYVXe%|%[E-d_#j4{nMzT7'>OgQ#a']6jL]cV0l0A
                                                                                        2022-07-25 13:17:43 UTC2258INData Raw: a1 07 57 16 15 09 ed 6a 7c f1 1b e6 8c 46 12 d0 c4 6e 63 ae 8a 47 dc 1c cb 47 88 29 99 c9 d0 d9 71 4b 94 d4 76 f3 b5 2e 60 1a 08 d5 19 b3 c4 da 06 1d 78 4e 09 b2 d9 b0 24 eb 22 26 d8 39 0f b0 73 e7 07 6b fe 7b 53 30 e3 27 24 96 5f 05 36 56 d0 d6 86 2a e4 9c a6 83 f8 60 94 44 c9 76 6d d4 c5 13 39 80 48 89 34 c5 53 aa 24 03 6f a0 46 e0 54 11 fe 61 9e e9 1b ee e7 31 b6 bb 5e 92 0f 45 b2 f0 4d 92 14 46 68 4e 71 d3 11 bc c3 b9 f4 d1 de 56 dc 35 03 49 4c b2 e0 4c 14 07 f7 fa 9f 6b 25 b5 68 4f 6d e8 9e 61 c3 08 7c 97 85 d2 17 46 c2 13 26 dd 42 c5 a8 31 6c 21 cb ca 21 97 42 a4 4e de e2 bc 1e 9d 40 23 76 fb 2b e5 b5 2f e2 02 ca 7a 4a 4b 46 02 fc 0b c8 c8 be 5c 8f 4e 2c 68 99 04 4b 7f 19 0d ae 37 50 b0 79 91 7b 05 41 54 31 37 c6 61 e0 b5 22 99 63 cd f2 c9 42 f8 cf
                                                                                        Data Ascii: Wj|FncGG)qKv.`xN$"&9sk{S0'$_6V*`Dvm9H4S$oFTa1^EMFhNqV5ILLk%hOma|F&B1l!!BN@#v+/zJKF\N,hK7Py{AT17a"cB
                                                                                        2022-07-25 13:17:43 UTC2274INData Raw: 37 dd 6e 5b 86 18 e4 a7 10 0b 5f 70 33 ff 8e 07 cf 45 8d 60 88 15 26 d1 d3 35 d0 17 13 37 36 ba e5 f7 6b c3 75 14 88 83 96 55 68 ac 11 da b4 4e 7c 2d a1 04 c7 a9 a2 b3 a3 8a df 7b cd 2e fa b1 27 93 73 fe 05 e9 2c 17 35 2b 0f f5 51 32 0b ab db 87 15 53 c2 10 e7 93 9c 6a fa 38 cc 8b 96 56 a4 7d 7f 26 54 dd d0 7c 45 f9 53 27 3e 0e 4a d6 bf d8 6d 06 c2 d5 4a a2 4a 1f 44 5f bc be f5 86 8e 4a a9 c5 ca 81 1e 38 15 94 55 1c 58 c8 06 70 a2 f7 6e bd 2c 39 b4 fd ba fb a7 86 a8 6d 53 c6 3b 44 2f 3f 75 1d 12 e1 96 74 65 48 02 ca e7 97 16 13 c1 46 aa ba 7f 9b d7 6d 7a 9e 40 67 59 66 c4 fb 8e e8 05 78 13 65 c0 ea cb de 92 d5 9d da e3 d8 bb 9c 72 03 b6 28 71 98 05 27 f5 1a a6 5f 80 f2 bd e5 fd e2 dd 84 67 d5 33 56 55 2e 47 56 42 09 bc 67 8e c5 f1 61 45 b6 4b 8c 98 26 bd
                                                                                        Data Ascii: 7n[_p3E`&576kuUhN|-{.'s,5+Q2Sj8V}&T|ES'>JmJJD_J8UXpn,9mS;D/?uteHFmz@gYfxer(q'_g3VU.GVBgaEK&
                                                                                        2022-07-25 13:17:43 UTC2290INData Raw: c9 60 96 f4 b6 7b 00 14 3d 21 e5 ff 63 72 d4 e9 c1 87 df 98 6c 01 19 a9 14 0b 54 88 84 90 87 71 67 2c ab 3c d6 e5 ac 87 4f 72 f1 1a a8 f8 b2 3f 8c 77 05 b3 b9 f7 3a cc 13 5b 36 6d 32 08 0a e7 2c 6b b6 d4 88 23 0d 59 ae 15 d8 f3 75 c5 52 92 90 a8 7c f5 5c 53 74 cc c5 0f ce b8 5d c6 c5 86 4a 89 9f 36 47 f8 12 6f 13 6f 22 4b 26 20 b3 ee 37 24 78 73 6a 14 1a 4e b3 d2 56 97 62 d5 f6 69 7a 24 6e f2 4b 70 d3 24 51 c1 a7 02 2a 08 20 ae a8 08 e5 9a 2a 38 42 0c 70 cb 05 f2 4f 6d 03 a8 4b 13 70 1f 0c 08 15 c2 98 22 38 61 a2 60 41 04 ef 76 68 64 47 55 be e6 c8 85 d5 c3 fd 83 25 84 f8 f0 46 70 96 cc c4 20 27 25 00 67 cf 70 7d da de 9e c4 d4 57 1a c2 22 1d 39 20 b2 74 50 7a f2 69 5e 1d b9 79 dc 2c 6f 60 a2 0f c1 af 65 d4 70 63 7f 45 20 ca 1e 05 fb 10 5f 37 fb 55 8f 0e
                                                                                        Data Ascii: `{=!crlTqg,<Or?w:[6m2,k#YuR|\St]J6Goo"K& 7$xsjNVbiz$nKp$Q* *8BpOmKp"8a`AvhdGU%Fp '%gp}W"9 tPzi^y,o`epcE _7U
                                                                                        2022-07-25 13:17:43 UTC2306INData Raw: e0 77 ba 69 0a 4d 21 f7 2a a0 61 6a 36 46 e8 da 15 ae e3 16 c5 ea 3d f0 ea 89 8d 7f 95 6b 78 08 a6 d9 d9 34 5d 0d eb fb 14 88 c9 48 23 9a 07 5b d2 27 16 87 8f 1a 87 a4 c8 4a e1 8b 91 66 58 c6 d5 04 3e bb bc b9 ee 75 45 4a c4 b5 56 ec 2e 4f 80 e8 95 a2 0c 93 da 23 72 d2 b5 c2 77 1b 00 e2 84 21 53 09 83 a8 e6 b0 08 18 71 1e d3 cd ec 44 04 9a c5 71 fc e5 ff a7 fb e5 f1 e5 45 84 7c 6d d7 75 7a ee 5f 27 46 05 1e e9 ab c2 e9 f3 2b 9b 59 e2 58 7d e7 06 f9 a1 7c 62 49 b0 aa fc 38 77 28 f3 6e fa c2 56 56 45 e3 2c 89 ab 46 d6 cc 99 72 92 b7 3a a0 29 f6 0c 39 a7 2c 32 87 a8 44 c8 2a 7e 8b 0b da 90 58 d9 73 4a 4e 7f 4c 50 53 4d 04 e2 83 d1 d1 4e fe 72 61 f5 b5 38 02 42 a8 2b 94 33 69 f6 b8 c7 1a 15 32 0d f9 ae 6e 5a 40 97 6d 72 5a 1f 65 29 b2 ae d0 58 d9 fb 81 16 f4
                                                                                        Data Ascii: wiM!*aj6F=kx4]H#['JfX>uEJV.O#rw!SqDqE|muz_'F+YX}|bI8w(nVVE,Fr:)9,2D*~XsJNLPSMNra8B+3i2nZ@mrZe)X
                                                                                        2022-07-25 13:17:43 UTC2322INData Raw: 90 ba 8c 57 3f 26 01 21 c5 68 b7 1f c3 b0 23 bc 50 29 26 b3 c9 6e 5f d7 3d b8 55 b7 00 ec ec 2c b4 5f 1a 0c 44 e1 97 89 eb 55 08 f2 d7 02 0e 37 b6 2f 44 1c 41 b6 ac e4 10 76 8b 8a f0 d8 d8 8f 15 62 64 c1 0f 95 53 ef 1c da 4b 6f d7 aa 33 ec 65 60 7f 08 90 b0 ed 3a 54 03 fd 56 a3 c2 d0 cb 81 cb 11 28 8c ce 4d 66 4c 52 5e 9c 50 98 09 9e ba ee 72 70 6f c5 34 06 4d cb 5d ce f5 55 77 09 9e ce fa 9f a3 f3 93 c8 79 19 25 71 cf 45 4e e0 8c b0 ff 3a a7 72 55 a1 69 f4 88 75 c4 68 83 6a e1 d0 9a 94 af da 44 cd 24 05 64 e9 2d 63 79 38 af 26 9d e8 5b 75 73 2e ac b6 fe fb 40 10 d8 82 11 4b d1 f7 c8 81 d8 08 74 7f 5a 25 ee b5 ed fc 98 91 73 69 ab a8 63 30 24 c7 e5 96 43 c9 6b 36 47 b5 90 64 01 2c 2f 3e 48 87 37 eb d4 83 d3 ee 02 3b c3 b9 48 86 20 c9 f8 c3 46 40 d3 95 06
                                                                                        Data Ascii: W?&!h#P)&n_=U,_DU7/DAvbdSKo3e`:TV(MfLR^Prpo4M]Uwy%qEN:rUiuhjD$d-cy8&[us.@KtZ%sic0$Ck6Gd,/>H7;H F@
                                                                                        2022-07-25 13:17:43 UTC2338INData Raw: f2 79 e6 a7 ec 1a 89 16 43 8c 4d e1 03 de 4c 29 6c d2 38 ea c9 27 92 c8 3a ee 3a a5 94 77 5e db 6a 31 78 ef 13 50 83 e7 bf e9 94 0a 47 1e 3f 82 9d b0 1b a3 61 eb d8 03 20 66 f3 d1 cc 16 45 2c 08 b4 3a 5b dd ff 01 42 a8 63 08 71 84 0d 9d ec 16 5e 9d ec 1c 4e 95 6a 4e 77 ba ab d6 87 7b d0 d9 63 bc ff 96 43 15 93 66 85 99 6f 67 87 c7 ce 8a 97 a5 f1 09 77 e0 c2 4e f7 86 ce fa ae 14 a1 48 88 df f3 26 8f 3d 57 36 14 9c fb a3 b0 fb c6 e1 2c 34 e7 5c 0b 10 a2 00 98 ce 21 7c 3d 1c 26 db 8d 19 f7 a9 bf d6 85 2c 1e 66 71 72 55 35 52 f2 1e 48 19 34 fa fa 69 2c c9 95 5c d8 0c b9 9c 86 86 48 28 34 72 98 94 31 93 f9 3f 3a c1 a6 53 c4 b9 e9 4d d2 e8 93 c8 b1 40 8d f2 50 6b 1f 26 78 9e b3 8a 7c 3a 77 2b 1e 84 0d a0 7a 10 46 83 fc 6b ee 8e d1 2a c4 b8 2b 1c 35 69 9f 56 66
                                                                                        Data Ascii: yCML)l8'::w^j1xPG?a fE,:[Bcq^NjNw{cCfogwNH&=W6,4\!|=&,fqrU5RH4i,\H(4r1?:SM@Pk&x|:w+zFk*+5iVf
                                                                                        2022-07-25 13:17:43 UTC2354INData Raw: 33 65 c6 7c 48 fc 2e ba 34 ed 7b 64 c1 12 24 53 a1 e1 57 56 f2 03 2c ce 43 0a e1 0a a7 3d b6 11 94 19 38 c3 98 41 85 b9 37 db ae 0c b1 58 3d 75 cb 7c e3 9a 4c 21 a6 4a a6 e5 58 02 fb 7a 69 4e 97 a2 17 28 77 48 36 43 a1 8f 15 f2 fb e1 69 63 de 91 da 6d 33 de 38 e1 59 c5 e7 f6 0f c3 72 fc 79 b3 cc 2d f7 e1 60 bd 1d 67 07 83 7c 75 14 95 cb 24 4b c5 32 a8 eb c5 e9 29 e6 31 9e d7 21 a9 52 3a e6 f2 c1 60 22 e7 37 da 17 19 56 bc f8 ba cc 47 d1 0a e0 62 0f e0 55 f7 5d df 51 1f ef d7 3f c3 ef 8b 7f 46 d4 d0 50 e7 03 9a 8e 2b 97 38 79 68 f7 51 08 b4 0d 55 fd 73 56 27 60 d3 63 70 ce 6b 1d 83 1d 27 77 2f 6b ae 44 b4 10 3b 22 82 52 71 c9 c9 74 33 51 c9 98 25 ed 2e 39 bf 60 36 96 6d 18 f3 c0 3a 45 bd 68 a7 c4 ae 90 36 2e 16 11 6f f8 53 39 00 24 8b 58 1f 46 da 31 23 8a
                                                                                        Data Ascii: 3e|H.4{d$SWV,C=8A7X=u|L!JXziN(wH6Cicm38Yry-`g|u$K2)1!R:`"7VGbU]Q?FP+8yhQUsV'`cpk'w/kD;"Rqt3Q%.9`6m:Eh6.oS9$XF1#
                                                                                        2022-07-25 13:17:43 UTC2370INData Raw: 9d 66 48 ad c0 57 97 d7 49 94 01 b2 4d 97 35 f5 93 92 6b 92 6e 10 3a 72 99 f4 92 7b 71 19 68 cb 9a 4e 68 bd fe 16 13 a9 03 be de d7 a6 bd 6a 06 6a d4 61 df 54 fe 12 7a 53 3f 02 e5 8f 87 1b 93 25 ae b7 59 59 24 da 02 41 f1 df 43 d7 c5 01 6b 86 c3 30 7b d5 23 50 a8 35 21 fa 84 3b e1 a5 d7 cf 4b d3 84 ac 2f f5 87 67 5f 70 f0 da fd 8c f7 65 bc 4c 23 f1 2d e6 cf c3 20 f8 ba c4 d0 f6 a7 0f 34 47 4f 18 59 02 37 d6 09 be 22 5d 85 f4 00 9a b7 de 31 72 16 d1 2e 4a 04 87 99 bb 55 5f 3d 93 7e bb d3 c6 75 cc 65 23 46 e4 65 15 08 75 47 bf f5 a9 8f f8 b1 98 2f a2 4a f6 85 26 28 2a ba 40 86 eb b3 c3 2a 1c c3 ff 1c 47 4a d3 88 be 45 b5 4a de 24 23 d1 26 7e 48 d2 07 59 f7 1d 33 5a f7 e2 2b 67 38 ea 28 90 96 5d 6f d7 87 43 79 91 67 ad 64 f4 64 3e 65 df f1 1f 41 e8 2f 68 69
                                                                                        Data Ascii: fHWIM5kn:r{qhNhjjaTzS?%YY$ACk0{#P5!;K/g_peL#- 4GOY7"]1r.JU_=~ue#FeuG/J&(*@*GJEJ$#&~HY3Z+g8(]oCygdd>eA/hi
                                                                                        2022-07-25 13:17:43 UTC2386INData Raw: 23 66 07 b1 bd e5 43 4b 81 ce b7 e9 1f 4a 1d 97 fa 0e 4d 17 03 e0 77 42 45 10 46 fd e7 2b 71 44 c4 c6 60 2c 4d 1b d0 4d 33 ac bc 6a c8 c0 e4 fe ee 90 27 8f a4 a4 e5 17 84 d8 ca 56 60 ed ba 11 17 fe 3f 23 46 1e 46 c0 f5 f5 66 fb 8f 9f a6 e3 5a e2 1c 53 7e 12 4a a8 4d d3 f2 30 9a 89 a6 f9 24 2f e4 b4 a0 2d 40 06 70 c7 04 d5 ac 42 95 c6 a7 24 71 4f a5 c1 8e 48 f3 6b 6a 42 5b 3c c5 2d be 14 8f b4 cf a2 da 32 81 ee bf 8a ed 9c ca 8c 79 16 a9 a6 e3 c9 0c 5c 45 f2 9b 1f 6d 9f 01 f3 5f e4 ff 84 68 65 93 c7 e3 a7 bb 48 f2 18 79 a3 40 76 6e f8 f1 1a 10 42 c6 59 0d e9 4b e4 10 30 e1 d2 f8 91 75 7e 15 57 b2 b6 6f be 91 27 48 cd 88 56 9c 0a 85 6f 04 0a 40 6c a2 fd 42 5f 18 8e c8 45 b3 98 43 bd b2 be ba c0 6b 33 5b 24 f1 7d 0b d9 03 43 91 57 32 a5 ba b9 50 a3 96 52 69
                                                                                        Data Ascii: #fCKJMwBEF+qD`,MM3j'V`?#FFfZS~JM0$/-@pB$qOHkjB[<-2y\Em_heHy@vnBYK0u~Wo'HVo@lB_ECk3[$}CW2PRi
                                                                                        2022-07-25 13:17:43 UTC2402INData Raw: 2c 7d 12 0f fe 63 c2 2a 79 4d a4 62 37 81 fa 79 ec 8d 6e 31 44 72 43 2d ec dc 30 7f e2 50 81 51 2c ed 9b 4d 34 7d a9 5f 37 ef 76 81 e1 f5 6e 5d d8 49 3e 01 8f 60 8a 6d e0 db 7b 23 43 3d 8d d9 0e cc 4b 9d ce c9 8f 46 32 ab b1 23 4a 07 0f 00 ab 6a ec d4 7b 87 2c 28 3f 9a 77 bd 39 8c 10 59 0e 8b 60 d1 bb eb 24 52 a0 27 21 df db e2 ed 6f 3b 0a fe 03 48 4d 54 b0 8b 6a c6 57 65 6e b9 87 38 3c 55 7b f0 e8 8b b7 e9 e0 78 b2 bb 2d 85 bc af fc de e8 6a a5 83 e1 c1 b0 e4 96 ea 86 fb e1 42 79 21 08 2b 8b 68 0f 3a 5b 0f 38 55 c3 84 d0 a3 f0 ca df 88 fa 93 43 9f 7e d3 f0 2a 74 5b c2 61 1a fc a1 83 d2 f3 8b d0 06 45 72 5c b4 7a 0f bb b4 a2 9f 95 37 6c 0e fc ed cb d2 70 cd c6 68 2e 9a 4e f7 4e e9 b3 6a bd 85 fc cd 42 8b 44 bd 36 49 60 f9 12 22 3a db f8 67 84 2b 02 5d 74
                                                                                        Data Ascii: ,}c*yMb7yn1DrC-0PQ,M4}_7vn]I>`m{#C=KF2#Jj{,(?w9Y`$R'!o;HMTjWen8<U{x-jBy!+h:[8UC~*t[aEr\z7lph.NNjBD6I`":g+]t
                                                                                        2022-07-25 13:17:43 UTC2418INData Raw: 2e 4e e7 6d d4 7d 95 a4 13 f4 cd 8c 34 eb 26 f3 8a 20 3d ac 2f f3 f1 b1 ca 55 b3 84 da 01 79 48 d6 8e ac 7b 86 e9 1e ba 44 61 39 4b a0 ed d7 81 8b ee 41 3c 07 6d 85 76 80 b5 9d 34 26 3b 97 58 2c 02 9a 83 07 85 dc 9d 42 fe 4e b7 b8 3e 67 9d 68 9f 2b 89 7b 3c 77 ce 4c cf 67 9a 47 f9 98 1a 00 26 df 4b 2f 35 4c 3b 08 16 6e e1 6a 2d f9 c1 26 f3 f5 e3 70 7d 21 1c ba 78 22 51 c9 ca fa ef 1c 8c 76 1b b8 b1 a3 11 c7 11 2b 81 44 69 d7 7c 77 4c 3b 49 c7 c2 8b 46 c5 f1 12 13 2e 38 e8 6d 23 7f 03 8f 8a ba d5 82 08 d7 5d 0d ac f4 5b 9e 3f d7 20 63 42 19 4c a3 cb 6d af fd dd c2 6f 76 ce 12 1b 31 6b 72 82 5d 32 93 ba 32 66 02 e5 74 be 44 17 f8 cc 62 e7 44 ab 7c 31 f7 f1 c1 a4 42 06 e0 87 f1 3f bd b3 31 ba 8a fb 3b 7e bb 51 05 07 76 60 b5 7d 15 c8 e9 b1 e0 da 0a b4 cf 30
                                                                                        Data Ascii: .Nm}4& =/UyH{Da9KA<mv4&;X,BN>gh+{<wLgG&K/5L;nj-&p}!x"Qv+Di|wL;IF.8m#][? cBLmov1kr]22ftDbD|1B?1;~Qv`}0
                                                                                        2022-07-25 13:17:43 UTC2434INData Raw: e4 fd 08 4f 13 ad d1 13 1b ab f4 96 d3 fe 77 a4 8b d2 64 f8 b5 b5 53 3e dc 27 2a 86 96 f9 2e ea 95 51 fc cb d8 1f 31 7a 9f d3 ad 61 d7 52 06 39 28 08 57 b3 94 07 e7 b4 59 b6 e3 04 cf bf 51 1b 98 82 58 f5 6f 60 26 f6 4f 83 12 df 4b 7c 8e 98 d6 31 85 14 af 49 b1 49 4b 39 46 b2 cf c0 ed 32 60 c1 2a cc 8e d6 46 8e 2f 94 2f 16 4a f8 c7 e9 d0 62 ef 29 f2 c0 f4 98 a0 59 b3 6c f0 b1 0a 3f 16 c6 14 25 b7 38 8c 7d 30 d1 3c 47 74 6f 5c 48 69 65 2c 24 64 b9 d3 8e 2d 11 17 d7 45 dc 8c 62 f1 09 aa fb 1a 3d 8a bb 1b aa 47 9f 54 ef 87 2f 74 ee 0e 50 e5 fe 53 7d 1d d4 75 93 58 da 33 06 3c c1 2b d6 16 d7 ed 27 f6 6e 04 cf d4 a6 6b f4 ff b4 c8 a3 0a 57 6f e6 b4 65 2e cd c4 44 00 1a c6 33 52 13 ca 3f b8 d7 ae 7f 50 2c ec a6 37 6a 6d 2e 93 42 4c 52 ed d2 27 29 93 5d 8c 88 b1
                                                                                        Data Ascii: OwdS>'*.Q1zaR9(WYQXo`&OK|1IIK9F2`*F//Jb)Yl?%8}0<Gto\Hie,$d-Eb=GT/tPS}uX3<+'nkWoe.D3R?P,7jm.BLR')]
                                                                                        2022-07-25 13:17:43 UTC2450INData Raw: d6 52 80 80 ca 16 29 f8 cf 40 b0 83 fa 30 7b 88 10 21 59 7f 60 6e 7a 84 bb 3f f4 a7 a5 00 a2 d2 e6 b5 66 a4 e6 f6 d9 3a cd 0b 0e 45 01 8c 5c 88 55 c2 b2 ad ef ec 6c 39 f1 ff eb 9d e5 bc 1a 0d c3 51 2b 82 07 c2 d2 6a b5 cd 2a dc b4 63 82 82 63 cb 43 0a 2d 0f b8 83 96 b4 80 44 0f b8 77 33 eb f8 41 3d af 1e f8 55 0c 94 f6 11 23 23 3a 38 43 cf 4c a6 6d a7 5a b1 26 e3 dd cc 45 fe ed f0 d6 09 33 96 a7 b9 ad 34 11 ba 9e 44 29 e5 bf 7f 4c 2d f8 c1 bc b0 9c 19 f2 66 65 95 d6 d8 fb 95 bf 1d ac c0 6e fe f9 2f 2d 65 e0 c7 3e 3f f2 59 b7 6e 5e 69 f1 a4 55 7f fd 31 ec d4 41 0b 70 ad 0c 7e bc 66 3b d8 3e da ec f6 6b 59 fa b9 02 a7 62 cd d7 ce 41 e0 a2 4b e9 77 f5 7c 50 a1 85 cd 6f c5 ed 5b 87 94 3c 5b a5 f1 26 6d 71 44 01 3d 40 eb 9e 1d 13 cc ef 7a 2a da 9e 61 05 9d 17
                                                                                        Data Ascii: R)@0{!Y`nz?f:E\Ul9Q+j*ccC-Dw3A=U##:8CLmZ&E34D)L-fen/-e>?Yn^iU1Ap~f;>kYbAKw|Po[<[&mqD=@z*a
                                                                                        2022-07-25 13:17:43 UTC2466INData Raw: 52 ec d3 89 49 3e 1b f1 3a 9e 75 e1 96 32 b1 39 83 eb 59 4a 31 23 62 61 3e 60 27 06 b7 da 84 b9 3d 52 0b 8e 81 5b c2 37 03 48 28 5a 35 77 17 3a 97 e5 68 df 45 da 92 f8 51 0a e4 cf 29 3d f2 a5 be 38 a3 79 20 5d c3 c8 d6 ae eb 15 05 b6 dd b2 a7 1b 95 f7 ca ce 09 a3 4a 85 0d d6 8f f6 79 b5 f8 11 c6 6f 86 23 0c e0 d9 79 d9 fc a2 e2 c2 b8 e4 58 d5 b1 f8 d6 f8 6c 21 84 1f c3 a7 22 7e 35 4e c7 89 d0 8c d6 de 5e 96 72 61 30 c3 b3 16 70 5f a8 8f 16 2a fd 51 fd e0 6b ac 8e 4c e5 0c 3d d8 b2 c3 ee af 3e f1 dc eb 91 5a 11 76 75 a7 f4 e3 6e 2d 0c 75 8f 38 25 74 aa 68 d5 7f 0f 6f 87 c3 9f f3 7d a8 e5 c1 a8 ab 50 46 5a a5 19 ab 39 a5 08 aa f0 e7 a4 83 62 1e d6 b3 07 ea 80 4a 82 3e a8 04 26 5a 70 85 92 98 7e 13 e8 7c 75 69 7f c5 4e a4 ac 66 4f e2 4e b0 bf 77 fc 13 14 74
                                                                                        Data Ascii: RI>:u29YJ1#ba>`'=R[7H(Z5w:hEQ)=8y ]Jyo#yXl!"~5N^ra0p_*QkL=>Zvun-u8%tho}PFZ9bJ>&Zp~|uiNfONwt
                                                                                        2022-07-25 13:17:43 UTC2482INData Raw: cc 0d db ec 7a a2 c2 51 05 2d 42 56 14 05 e9 d0 52 78 d9 6b 82 2c 89 31 f2 fb 67 3c 42 ed 69 3c d5 2f 74 b0 05 47 ec 7e 74 5b f6 af 5b c6 5a 3a cb c0 59 0a 2c fe 64 8f 7b 29 89 3f aa f3 27 64 ee c6 46 39 87 62 d0 06 c8 c9 17 a2 e0 69 bd 5f 20 42 9c 0a 00 5c 71 19 2c e1 28 40 aa 4f 7d d3 77 2e b0 0d 44 51 e6 a4 61 d4 a0 10 86 4f a7 a8 54 84 4e fe 0f 67 07 f4 a1 a3 1b e8 41 07 ec db e2 95 d7 3a 94 72 da 7f f2 cd 88 dc 32 13 b7 af 67 72 2e 1f 6c be e6 df 7d f9 21 e5 21 ab f0 fe 03 28 f8 cd c6 74 99 90 79 05 ef 54 7c c5 ae 7f 34 ed a5 17 dc 25 96 70 cb 91 9f bd c4 8f 32 63 ed 53 48 6b db d8 2c 30 3b 7f ba 9b 02 da 28 2f d2 c8 fd b8 cb 2d d8 79 1e 78 51 16 e8 5a 47 3a 45 42 d8 68 0c d0 2b 2c c2 4d 08 44 7b 0e c0 36 b2 b5 91 48 ab d9 f0 c0 07 1b 82 80 3c 36 ce
                                                                                        Data Ascii: zQ-BVRxk,1g<Bi</tG~t[[Z:Y,d{)?'dF9bi_ B\q,(@O}w.DQaOTNgA:r2gr.l}!!(tyT|4%p2cSHk,0;(/-yxQZG:EBh+,MD{6H<6
                                                                                        2022-07-25 13:17:43 UTC2498INData Raw: c5 1e 95 c9 a2 19 e2 e8 f3 30 c1 22 b9 ee 79 40 e3 0b 9e 3a d1 63 24 2f d1 ce 21 94 0d c5 5e 69 03 03 01 e3 21 68 d7 e7 56 86 e8 32 90 0b 40 f4 c3 7b fa 59 df b3 e5 3f ce 3b 09 02 95 97 f2 34 fa f8 94 e0 3d db 29 27 e2 5b 88 4f 6f ee be d6 fe 9b 2e 18 e7 54 ec f7 77 80 96 03 10 c7 05 d4 e9 20 3c 08 9a 26 c0 53 9f 4c ee 9e 20 9d 08 d5 c3 ec 50 88 7b ed b6 81 ad 91 d6 02 95 f3 eb 6c d8 17 68 11 34 cb c1 2f 90 aa 1c ca 6b f2 f8 e1 5f 4d 5d 56 de a9 11 77 15 0f bb f7 7a ad 11 b1 5d 35 37 85 e0 20 c2 a6 f3 5b d3 d1 57 a6 90 bd d2 07 96 07 29 33 18 99 f6 ba 63 72 18 63 6c dc e5 a1 9e 4d b6 42 69 62 ad 7c 73 27 a6 0b 6e f6 37 64 12 e6 bd 0f 09 f0 43 6f d0 d9 2f 00 13 2f ad 35 8f f8 1e 0a 41 71 ea f8 ec 96 a0 d4 d6 ba 6e 84 3b 38 e0 ea ff e3 8e 61 69 31 75 16 9c
                                                                                        Data Ascii: 0"y@:c$/!^i!hV2@{Y?;4=)'[Oo.Tw <&SL P{lh4/k_M]Vwz]57 [W)3crclMBib|s'n7dCo//5Aqn;8ai1u
                                                                                        2022-07-25 13:17:43 UTC2514INData Raw: 7e be 27 e4 51 54 75 5e de d0 67 75 58 e9 17 65 4c 7f 01 00 69 d7 2f e6 1a 05 21 31 f6 b5 30 da 35 a4 c9 f6 a5 c7 0d e4 53 dd 52 bc 19 c5 04 a5 d7 9a 19 bb 18 29 c0 18 3c fb da 74 d3 c9 ce 3c 68 0e 75 7e 57 04 79 26 22 7b bc 11 c3 bc 3e 07 ee 0d 54 c6 f4 88 0d fa ce 61 ed 9b fe 05 d4 98 14 cf f1 fc 5a b7 da d8 8e 49 75 5b 0a 17 d2 40 7a 82 5e 16 9f 36 29 1a f8 c3 c1 f0 0f 70 df b4 8e 19 19 11 3d fc ce 48 75 f9 39 57 ee 43 9d 1e dc 8f 30 33 92 4e b1 69 a6 91 73 f9 d5 04 f7 a0 a6 a8 8b fe 30 60 14 cc e9 5e 3b 6a 3e 16 32 af 29 1c 36 d0 72 60 53 90 3c 22 e5 d4 8d ac 04 61 c4 01 df 20 99 71 86 0f 2a 7f 6c fa b2 1f aa 8a 82 7f ca 56 fe 5d 5c f6 56 ce d1 da 25 4c d7 d7 f1 0f e7 fc d8 69 5e 09 69 b2 06 96 11 8b 1c 20 50 10 06 41 ef 1d a0 2d 34 f4 c6 58 4e 99 83
                                                                                        Data Ascii: ~'QTu^guXeLi/!105SR)<t<hu~Wy&"{>TaZIu[@z^6)p=Hu9WC03Nis0`^;j>2)6r`S<"a q*lV]\V%Li^i PA-4XN
                                                                                        2022-07-25 13:17:43 UTC2530INData Raw: af 8e 3f 68 4d ba ca 13 0f 1f 8c 1e 24 48 4d e3 32 d7 89 e6 df de 9a 74 59 ce f9 51 95 be eb 37 05 ff c5 e9 d1 5a 96 a1 96 b7 17 16 20 0b d6 83 b2 4f 59 74 f1 29 95 01 7f 18 10 3e 70 21 49 1c f4 78 fb 1d 44 f8 11 ed 73 7b 39 ec 84 09 32 15 a8 30 61 79 63 04 75 1b d4 95 67 31 20 10 df 0b ca ae 03 c6 1e d2 bb d2 ce 0c e0 61 3a 81 72 58 3d e5 f6 4b 7e 9c f2 8c 61 75 e9 ed 04 2d 11 17 83 9e 28 03 5d f3 e4 01 5b 42 0f e3 27 1c 16 87 81 c0 0e a8 c4 73 8f f3 8b 19 b9 18 c5 aa 3e 0b 3d e9 e9 e9 ad 9d 93 b6 0a 1c 52 af 00 35 f9 9d ec a9 37 d9 53 04 51 a8 48 fe 45 44 c8 a0 57 d1 8d d1 9d d3 67 e7 23 bc 68 26 4e 1f 66 63 4d a1 98 5b c6 87 39 37 48 9b 74 0a cf b8 47 e8 2e 8d 2a 3a b0 43 05 eb 82 6a cb f6 55 fd f1 b0 d4 82 98 bc 96 a9 28 63 79 ca b8 bc 7c 51 51 5f 32
                                                                                        Data Ascii: ?hM$HM2tYQ7Z OYt)>p!IxDs{920aycug1 a:rX=K~au-(][B's>=R57SQHEDWg#h&NfcM[97HtG.*:CjU(cy|QQ_2
                                                                                        2022-07-25 13:17:43 UTC2546INData Raw: 5d ce 95 4b d1 42 81 73 53 23 24 d3 97 51 4a ed 80 5e 20 9b 71 42 37 f8 54 36 29 65 cd 2e 82 8c ef e8 95 3d 03 a5 8f 85 1d 62 cc 63 42 8a 10 6e c9 74 a8 c6 cc 30 be cb af c5 b4 69 f8 4d 78 f2 72 5c 90 74 86 71 8f 83 99 5a e1 d4 e2 94 d2 4b f5 c5 0e f4 45 f6 2f 73 16 18 33 d0 d9 b4 bd f2 ce ab cd f4 03 9c 99 59 2c ad c5 25 ea 6c f3 95 3b 70 c9 46 4b f1 5c a5 df 49 01 af 82 c0 71 7b 89 da 6e 16 45 77 50 99 63 85 91 86 2e 87 82 cc 34 2d b3 9f e4 70 af 51 6a e7 d9 76 ee bf 52 eb 41 7d 98 ca d8 35 f9 44 c3 31 35 a9 69 3b 55 45 83 82 49 5b 56 46 55 d9 07 77 11 a9 34 1f b7 de 25 fb 74 bb 17 48 37 62 d4 0d 67 57 c8 e8 4c 61 74 0a ab 85 03 57 b5 e9 56 6a ba 24 56 54 05 e3 ec 68 b3 3b 80 e3 c2 19 b4 f3 83 b0 0d a9 43 91 35 e8 8c 63 7c 2d f5 8b a6 f1 18 a5 98 dd d4
                                                                                        Data Ascii: ]KBsS#$QJ^ qB7T6)e.=bcBnt0iMxr\tqZKE/s3Y,%l;pFK\Iq{nEwPc.4-pQjvRA}5D15i;UEI[VFUw4%tH7bgWLatWVj$VTh;C5c|-
                                                                                        2022-07-25 13:17:43 UTC2562INData Raw: e2 a0 1e 88 54 ed 89 01 ce 7b fc 5d 89 16 4d cc a5 2a 18 df 46 e4 10 00 f5 f0 fa d5 26 ec 09 15 62 62 ae f3 21 63 51 9e e5 d3 80 19 60 41 2c 67 16 e7 2d 1f 0d 3c 11 18 ca c2 25 3c ca 49 51 52 33 b5 26 f5 c9 b4 36 0a 30 26 70 60 52 a0 99 ae 42 3d 03 a3 5b b3 4f e6 e0 8b 58 78 ba c2 f4 cb e6 33 d6 dc 74 d0 79 c4 db 54 37 cb 16 a8 51 9f 13 2b f0 59 d4 db 97 3a af cf 82 fc 01 81 16 cd 7b e4 0a 43 ed b8 76 e2 39 64 a4 83 60 04 8d f6 e1 8d fd ef db 9f bf 6f db bc 97 82 54 82 9f 6c 27 6c e7 66 ca 10 94 73 93 13 97 a1 98 c0 33 0b f6 1a aa 1f 9f e1 61 a7 3d 9b db 20 f5 e1 d7 3f 43 c8 4f 68 20 13 a1 df 5c 21 c8 a8 0a b1 80 fa d9 21 54 97 b6 2b 1f 90 f8 3d bc 4c 13 ff 6d a2 c2 d3 ff e1 a0 6a 86 ae de 75 1f ec 85 9a a0 96 7c de 39 ec 5b e1 1c 10 cc f0 a8 e7 99 96 d2
                                                                                        Data Ascii: T{]M*F&bb!cQ`A,g-<%<IQR3&60&p`RB=[OXx3tyT7Q+Y:{Cv9d`oTl'lfs3a= ?COh \!!T+=Lmju|9[
                                                                                        2022-07-25 13:17:43 UTC2578INData Raw: ae b8 ce c3 db f6 6a c5 6c 6d 32 53 9e 4f f7 39 8f f0 54 50 5e 36 2c 40 eb 4d 46 85 49 14 77 c2 b4 dc 72 d8 10 a1 94 69 e9 d3 da 34 10 6e c7 4a 3e 4b c5 02 84 ad 1e 14 6e b7 99 06 9c 31 39 be db dd 4f 07 9b 63 48 d5 17 38 39 8d 94 20 a2 a4 09 36 64 9c c8 91 fc 64 26 81 05 95 ef 6b 64 ea ec 54 fe 97 84 39 ff 8c b6 fb e0 89 30 7c 84 f5 b7 99 7c da b2 6f e5 6d 57 77 b3 a4 3e 2a 07 83 80 57 b4 85 83 0f 61 4a 1c 93 e2 b0 48 7d 1e 4a 4e ea 3a 3f ae c7 e6 25 00 03 08 42 64 67 01 aa 86 0f 85 39 ce 1c af 89 1c 44 e8 cc 8c c2 0b fe 65 80 a6 db 59 af 4d 1c 65 de 5d 01 de be aa b3 86 e9 58 17 a5 ca f4 a6 eb 22 19 7c c1 5a 29 f5 15 0a 4c ec ee fe fe 1f 13 23 c5 72 55 5e 32 60 94 4f 1b 53 51 39 e2 63 b3 42 51 7a 34 30 2b d3 51 0b 98 ea 9a 79 0d 0a 68 fb 36 8f 23 94 5a
                                                                                        Data Ascii: jlm2SO9TP^6,@MFIwri4nJ>Kn19OcH89 6dd&kdT90||omWw>*WaJH}JN:?%Bdg9DeYMe]X"|Z)L#rU^2`OSQ9cBQz40+Qyh6#Z
                                                                                        2022-07-25 13:17:43 UTC2594INData Raw: 51 e1 e0 f9 7d 9d 1c c6 a5 ba 57 5b e5 49 db 41 11 dc 97 1e f6 1e cb 28 c2 85 5f 8a 25 a4 9d 7c 2f ba ad 7a fb e5 af 18 1d 58 42 2a 89 dd e0 a2 d3 55 45 99 b9 fe cd 54 f4 d7 bd 5c 99 ce a6 a0 ef 60 a4 a1 84 ee c9 cd 57 f5 c4 92 2e 93 b3 3c a1 aa fb 05 9b ee f9 88 6f 08 68 70 0d a8 5f 52 b5 1a fd a4 fa f1 62 33 85 1d 2a 6c d6 8d 2c 31 0a 17 4d c6 d3 a4 7d 87 c0 f4 2e ab e9 48 a6 04 8f 29 4d cc 22 4e 5f 07 d4 ca 34 78 04 0e 4a 95 cd aa a6 b1 93 6a d4 0f db ca 57 a1 71 88 60 32 07 1d df 58 d4 b4 96 fd 64 a3 f9 4a bc 87 fe 61 13 6e a5 c7 2e 62 2c 2b df ac a8 f7 fa b9 16 7a e6 15 3b 81 53 ac 33 d7 c1 2f 3d c3 55 39 2e 3b 1d 13 5e ba 92 36 81 1e 1e fa 35 be 9f b6 28 50 05 0e 73 ed 62 f1 e3 65 62 6e 13 1c 8f 0a 7e 62 5d 5e 57 1a d5 cc 8d 5a a2 df ed 95 c3 c9 9d
                                                                                        Data Ascii: Q}W[IA(_%|/zXB*UET\`W.<ohp_Rb3*l,1M}.H)M"N_4xJjWq`2XdJan.b,+z;S3/=U9.;^65(Psbebn~b]^WZ
                                                                                        2022-07-25 13:17:43 UTC2610INData Raw: c8 d6 a7 fd 93 64 25 8e 50 cb ed dd 96 4f 83 a0 7e fa f1 fb bc cb 68 9b 20 db 86 3e 24 f2 70 89 ca 54 1c 5e e0 8a 6b 13 8c 21 c2 53 d5 18 f3 f3 44 b6 87 88 e2 18 7c bc 03 b2 b0 78 3e 99 83 70 b6 48 01 28 ad 7c 39 6f 6a 96 09 01 5b b0 20 7e fe 30 16 35 c4 8d d5 4f d9 1a 95 89 ee 1a 11 8e 5a 77 36 c7 3f ed e1 05 31 49 ed ce b7 10 9b 2b 05 e0 b4 50 2b 88 a6 22 0d b9 b5 b5 ba 80 7a 0a 1b da 4f 5d d6 b0 bc 16 53 f7 33 3c d9 5c 92 cb 53 ab 5e fc 3a 52 c4 d5 c2 b5 91 7f 6f 8f 25 42 a5 fc de db 79 64 88 f9 e7 cd 80 ec 7d 49 cd 99 6d f2 5e dd 07 5c a4 d7 a5 cd 12 a3 c3 bb 9a 2b e5 33 f7 f0 0f c7 e1 f1 95 ce c0 02 e5 91 12 22 4d f6 37 db e0 b2 d0 64 3a 4c 93 fe bb fe 91 e7 ed 86 a0 1f a7 72 91 8f 92 10 ab 06 67 ea e3 b6 1b d1 a1 ff 12 90 cf 5c e6 6a 41 12 d2 bc 5d
                                                                                        Data Ascii: d%PO~h >$pT^k!SD|x>pH(|9oj[ ~05OZw6?1I+P+"zO]S3<\S^:Ro%Byd}Im^\+3"M7d:Lrg\jA]
                                                                                        2022-07-25 13:17:43 UTC2626INData Raw: df 84 68 f5 4b 6f 43 39 fc 8c ea 66 c5 30 b0 80 cd fa c4 f7 33 3a 10 d5 15 38 b2 16 41 8f 45 cc ee 9e 2c 89 0b 5a ae 1d 02 a5 fb 66 cc 74 f5 e1 5b 4a b2 65 42 b2 28 41 59 8d 0f 6a 7a 4b e3 67 6c 9b 07 f5 0a 8c a1 5c eb fa f0 00 85 00 77 a0 67 51 cd 41 7f ec 25 76 a9 d1 f5 5c 00 53 10 77 cc 02 eb ca 96 2d eb 74 fa 39 7f 8e ce 99 b1 e6 05 11 75 cc 22 59 52 08 b9 c5 6a 12 fa 2a 27 0f 23 c7 12 cc a7 1a 85 0d 93 49 87 34 18 d4 d2 d9 38 76 94 bb 51 c5 2c 7b 64 c8 31 4c 0e 7f 5b 1d 24 86 e0 7a 40 85 34 5e cf 53 8f 8f 68 12 11 88 dd 4e 87 d2 1c 9b 4f a4 24 d6 a5 52 de 41 04 4b 68 e2 92 a0 0c e7 d2 f9 2d 45 eb 15 89 18 31 1a 7a 72 e5 a5 85 83 a3 ac 9f 5f 1a 11 e8 8e 47 41 0c 6a 51 b3 f8 47 90 d5 e3 27 0d cc 3b 42 02 eb 4d ef c9 81 88 5c eb 70 c1 ce 9c 23 ca 00 b6
                                                                                        Data Ascii: hKoC9f03:8AE,Zft[JeB(AYjzKgl\wgQA%v\Sw-t9u"YRj*'#I48vQ,{d1L[$z@4^ShNO$RAKh-E1zr_GAjQG';BM\p#
                                                                                        2022-07-25 13:17:43 UTC2642INData Raw: be 29 f8 12 49 8e 53 c8 22 62 d7 eb 57 9b 80 34 1c 66 c8 2f 7c 31 21 6b f9 3b bf 4e 28 02 d9 8f 50 32 65 a0 95 66 5f 2b 97 fe 50 1a e1 33 4b b8 4e 79 40 90 56 05 f1 58 35 19 0b e5 7c a2 66 9d d9 19 5f ef 46 cd 30 de 08 df 23 1b 1e 08 c2 5f b6 d8 2e fa 5e bc 34 5a 8c 3a 0b f2 75 d9 2e 1a 07 87 88 bc e7 6c f6 d3 29 f4 16 ac 77 e2 5d bc 82 84 a0 e6 1a 2c 08 c4 0a 30 bb e2 c3 c9 2f eb 4d c5 4c f7 03 de 3f 78 74 43 e2 cd c9 46 bf 27 25 59 e7 3b b3 42 6a 41 29 ad 36 25 4d 0c 7e 6e 2e 50 44 81 20 b2 78 9b 82 2f a8 c6 5e c8 f5 fe 93 7f 4a 23 7f a5 51 a0 08 7e 72 04 24 76 dd 30 7c 2a 17 be 26 a1 15 b6 8c 3b 82 1e bd dd 53 ea df 7d 4c 33 01 60 85 6e 8f 1e c1 a4 f6 86 cb 19 e8 20 de 96 25 3b ac 80 27 1d 29 52 40 77 19 ce 77 67 fc 96 02 9a 76 bf a0 db e7 c0 f2 ae fd
                                                                                        Data Ascii: )IS"bW4f/|1!k;N(P2ef_+P3KNy@VX5|f_F0#_.^4Z:u.l)w],0/ML?xtCF'%Y;BjA)6%M~n.PD x/^J#Q~r$v0|*&;S}L3`n %;')R@wwgv
                                                                                        2022-07-25 13:17:43 UTC2658INData Raw: 36 3b 25 6c 3a c3 c3 c2 08 57 53 b8 40 ec 6c d4 3a 39 65 12 fc b8 68 27 6f 28 96 e3 68 95 b1 db 55 c3 ff 5a ea fe f8 7b 94 37 6e 47 24 81 77 71 30 b1 94 a2 fd 51 ec 91 d8 b1 c2 54 85 98 05 b6 44 cb d3 a5 bb 5d 5e 6b d7 02 cf b6 ad d9 d7 66 7e 36 6f 11 46 6b ce ce 59 d6 2c 54 2d a3 32 77 4c 7c 0c 17 9c 0b 20 dd 59 6d 6f 2b bd 30 66 5f a9 65 fb 47 97 ba b5 44 02 3c 11 bf 2a ef 78 0c ac ff cf 92 2f 7c dd 7a ca d7 64 ae db 93 88 97 48 bd 98 a6 3e 5d 95 66 23 b3 42 e2 51 20 38 90 1d f4 e9 e5 5c 2d 4a a4 70 17 21 3f de 44 84 cf b0 a5 5b 94 6c ab 23 f3 17 7c 38 51 c2 b6 c3 31 e7 fb 78 49 11 7c 26 79 40 bd 43 39 6c 24 d6 79 60 df ba 6b a2 99 02 1b 39 9d 3b f0 43 d1 9f e1 d9 88 6a c2 4b f7 46 b4 df f1 a9 ad c5 d3 46 d9 ce f7 c6 7c 09 8e f1 40 7f 4d 05 47 89 9e 94
                                                                                        Data Ascii: 6;%l:WS@l:9eh'o(hUZ{7nG$wq0QTD]^kf~6oFkY,T-2wL| Ymo+0f_eGD<*x/|zdH>]f#BQ 8\-Jp!?D[l#|8Q1xI|&y@C9l$y`k9;CjKFF|@MG
                                                                                        2022-07-25 13:17:43 UTC2674INData Raw: 54 eb 21 37 71 bb 60 3f e4 de 40 64 2f 77 e2 d7 27 d7 aa 35 cb ee 81 3e 04 59 1d 0a f0 77 50 31 38 6f b2 02 15 d8 d4 46 11 da 65 81 12 74 78 52 2c 92 65 3c f4 c0 d9 40 8f e4 c4 f6 a0 1e 44 fd 0b d0 ac 10 c0 2a b3 61 50 82 c2 e6 2d 07 42 ee 3f 36 25 04 7d fd 70 9f c7 88 77 31 88 eb 38 8a 77 95 4b b8 f2 d3 75 22 67 75 25 2b 37 0c f3 35 a9 0a c0 e4 26 06 3e de c7 86 fe 1f cd 1d bf c6 1f f3 62 02 d9 ea bd 9e 00 8f 77 a0 08 13 d9 9c 4a b5 eb 55 26 12 75 ad 4b ae 74 a2 df 8e 4b 2f 4d 3a 11 bf 5a 9d 5e c8 bf 3b d2 5c 6d 05 c4 a8 7e 94 97 3d 3a 34 ef 33 3e 71 72 f1 b3 54 be 5b b3 f1 76 2d bd a5 49 cf 80 26 bb e7 36 42 d3 1c 11 5b 51 76 45 7f 0c a9 f3 e9 88 00 7c 07 06 b7 0d af 74 41 7c c3 0a 55 bb b2 42 8b 48 38 54 b4 cc c6 2d 0b a2 2f ab 7f 58 15 4e 68 bc 94 84
                                                                                        Data Ascii: T!7q`?@d/w'5>YwP18oFetxR,e<@D*aP-B?6%}pw18wKu"gu%+75&>bwJU&uKtK/M:Z^;\m~=:43>qrT[v-I&6B[QvE|tA|UBH8T-/XNh
                                                                                        2022-07-25 13:17:43 UTC2690INData Raw: 3c 32 3e 1e 71 fc 0f 8e 5a 77 dd 61 27 c6 7b 47 c8 75 12 c9 79 40 16 ed bd 8b 7a bb 76 f9 20 37 a0 8b f5 a1 b1 47 1e 00 77 d0 68 5d 02 a5 64 4d 81 08 29 ff 25 e2 bd 48 d7 e3 f9 42 ba 79 7d 75 3c c3 75 36 13 93 22 89 ee 3c 0e d8 2e ff 4f 94 97 a9 c4 45 10 07 54 39 e6 76 5f 0f 1b ae d8 8f 4d 0d 7e 2c 50 ad 6d 30 e2 23 b5 46 76 fa f7 b6 58 95 e8 05 7b 52 38 76 86 0d aa ce 2f e3 aa 8b b2 00 19 aa a0 b7 a4 cf 97 d6 3e 54 0c 41 d4 cc 09 86 ec 9d 38 c4 4b b1 31 6d d1 7a 55 f1 ec 48 79 17 34 94 2e 12 b9 eb 95 9c c7 ff 13 d4 0d 78 56 35 74 38 5c b1 a3 ab 9b 41 53 cc 7f bb 95 dc e9 c2 0c cd 7f 23 dc e4 c1 e6 ef c7 81 4a bd b1 e3 ca 8a e2 d8 1e 21 ea b1 f5 8d a7 b9 fb 06 0d 48 53 82 1a 67 a6 c5 85 1c 87 bb a9 69 c8 b3 7e 62 1a df 16 4d 60 35 2e e3 b6 e4 96 eb 7a 86
                                                                                        Data Ascii: <2>qZwa'{Guy@zv 7Gwh]dM)%HBy}u<u6"<.OET9v_M~,Pm0#FvX{R8v/>TA8K1mzUHy4.xV5t8\AS#J!HSgi~bM`5.z
                                                                                        2022-07-25 13:17:43 UTC2706INData Raw: cf 89 74 a3 87 ac 3f 0c 27 db 8c b4 e1 15 ab ae 87 68 ad f3 23 fc 44 a8 4a 93 df 33 9a de 65 28 72 fc 0a 8e 77 b3 ec 88 8a 9d 52 0e 6d d6 42 3c 16 1f 35 34 d7 9c 5e 08 e8 bb 91 f9 9e 8c 98 bc 9d 9d 49 00 40 d1 ec 6a b5 14 ef 3c 55 7d 80 ee 3a 04 6c f4 08 6a e1 21 a2 98 10 e9 d4 76 15 e6 15 2f d2 05 cb 59 78 45 f7 a7 c4 04 bf 87 a8 80 b5 26 ef 71 b7 a9 66 1f 82 20 5f ff 60 ec 0f 1f 78 9d fc 79 5d 64 74 a8 92 3d 17 f5 0f 5e 12 31 69 c7 d1 4f f3 d3 a2 89 9d 84 2a c4 4f 13 bd ef a5 78 e8 46 bf 23 d4 5b c6 67 a8 5e ed 19 bc 86 4e b0 48 59 70 39 3b 22 55 10 54 d7 ec 97 ec d1 af 14 20 cc 2e f1 4a b2 49 1d a3 72 1b 93 4b 6b c6 0a 37 a3 55 43 cd 9e 59 46 8a 38 ce d8 62 cd be 0b ca 73 10 3a 4d 2a 9f c6 b7 52 72 51 15 95 e4 08 be a0 fb d6 96 ca 7e 34 5f 25 6a 41 f3
                                                                                        Data Ascii: t?'h#DJ3e(rwRmB<54^I@j<U}:lj!v/YxE&qf _`xy]dt=^1iO*OxF#[g^NHYp9;"UT .JIrKk7UCYF8bs:M*RrQ~4_%jA
                                                                                        2022-07-25 13:17:43 UTC2722INData Raw: 6c 3d c2 b4 0c 1c d8 7c 77 3d b6 be a6 20 f7 a5 1d 67 e5 20 85 8b c4 51 90 11 c0 98 08 5c b3 14 46 71 8e a5 3c b3 79 a7 d0 22 cd 6f 8a 13 3d 24 94 0c fe 49 71 c6 b3 76 8f 81 90 46 4e fa 57 be 20 d0 47 d9 3b 7b e4 b5 9c 3b 0a 6a f0 89 33 d6 31 9e e1 74 78 e9 f9 8a d7 c4 ed be 0d 7e 3e 14 91 bb 4c e8 7c f2 f6 9e 32 57 5c 32 49 ea 82 0a b2 64 55 a6 17 1f 8c 4f 57 88 46 4e 1f ab 5a 2f 40 6b 41 0a 97 9d 33 d6 25 bd b0 de cc 2c a3 97 77 81 c5 8d 2b 8b 1b bc 5f b1 f9 6a 0d 85 f8 28 36 80 91 92 67 1d 18 f7 4d 9a 16 3f ac 74 5c c3 42 2e 0d 04 8e 0b b7 a7 82 ca a7 8e 0a 70 60 60 e3 12 0a d6 cf 89 75 dd e6 4c 21 76 c7 37 a3 84 ed 17 b3 6a d0 92 4d 81 78 67 d9 ec 7f 5c 04 59 86 a0 0c 8f d0 33 02 5c 64 92 ad 2a f7 5d 63 8a f2 bc 97 37 0f 02 30 83 6e 87 ae 20 a2 39 0d
                                                                                        Data Ascii: l=|w= g Q\Fq<y"o=$IqvFNW G;{;j31tx~>L|2W\2IdUOWFNZ/@kA3%,w+_j(6gM?t\B.p``uL!v7jMxg\Y3\d*]c70n 9
                                                                                        2022-07-25 13:17:43 UTC2738INData Raw: 79 e9 e5 ed bb 5a 35 52 1f db 27 0e 73 7c 00 65 0d 90 8c a6 40 e8 0a ae a0 71 ad 84 0c 93 0f fa 53 20 0c 7f 60 6a 46 b9 28 79 5b d1 f6 d8 59 b1 f6 50 f2 0a 26 95 48 d2 20 f4 e7 97 db a9 5e 9c c3 b7 ea 09 6a a9 ca bd 32 cd 9c 4f b1 82 11 a4 80 b3 b5 4b 00 49 0b 6f b5 b3 17 ed 87 f7 96 2a 2e dc c2 60 e5 13 9a 51 15 a2 ef 52 33 91 93 b2 de 8b 30 4e 02 bf 12 7e f4 9f a2 ac 65 39 4c c6 5c db 7a a3 5d f8 dc cb de 67 b4 55 36 fd 7b 98 c5 b5 a0 2f 50 e0 6f 85 31 b8 42 ae 62 2f b3 33 d6 e1 1c f2 8e 10 48 94 ae e3 1c 07 d6 92 6b 78 42 12 6e 29 6c d7 48 c2 4a 29 a7 f9 cf 89 63 16 89 5d 41 f6 25 66 95 b3 eb f8 2c d0 0c e8 fd be fc 08 84 84 16 c5 42 c1 13 47 b6 c7 fb 48 36 75 c2 55 30 4a 80 f8 1e 70 d3 a3 29 7d 33 7c 34 ef 54 54 52 45 74 c9 e6 3b 27 0a 7d 28 5f f7 cf
                                                                                        Data Ascii: yZ5R's|e@qS `jF(y[YP&H ^j2OKIo*.`QR30N~e9L\z]gU6{/Po1Bb/3HkxBn)lHJ)c]A%f,BGH6uU0Jp)}3|4TTREt;'}(_
                                                                                        2022-07-25 13:17:43 UTC2754INData Raw: 1d 33 1d 78 b6 54 e3 49 f5 b3 3a 4a e8 04 ad 5f 6f 76 53 92 da d9 16 36 39 92 96 b9 25 7d 98 56 3d 93 ba 84 23 e5 b8 52 63 f3 36 10 5b ae 49 1c 61 65 3e 49 f5 8b 88 4f 97 57 ac 84 72 2f 46 0d 79 49 fd 13 40 ab bb 69 de a7 b1 33 11 39 69 e4 a5 ba 70 6d 62 57 8f 79 1b d2 ca 5f 69 72 df 1c 3b 79 a5 cb 8b 5a c0 df 09 0f 3b 75 a1 6e 9b 8f 43 6d ad 91 10 31 77 96 31 82 ff bc 68 a3 a8 6f 9b 7d cb a4 ca 27 a2 17 23 cd 3f 75 d0 a6 9c 66 bb d6 19 07 4d 3d 14 1a a2 c6 f4 11 4f 2f 3a 25 00 69 98 46 96 4e dc 48 69 70 8d be 2f 82 96 6d 62 ef 03 71 b7 47 15 c4 5a 9f 16 33 10 04 1f 07 46 d4 99 84 a2 f4 18 66 80 7a 8a 7d 35 ca f2 65 f8 c5 06 95 d4 0c f6 ee 14 3d d4 6a 09 12 c7 c1 cb 97 97 b0 b5 93 d2 00 a1 00 f1 e8 44 aa ee 0e b0 23 a9 80 07 a7 e7 38 a4 4d 2b dd ea 7d e2
                                                                                        Data Ascii: 3xTI:J_ovS69%}V=#Rc6[Iae>IOWr/FyI@i39ipmbWy_ir;yZ;unCm1w1ho}'#?ufM=O/:%iFNHip/mbqGZ3Ffz}5e=jD#8M+}
                                                                                        2022-07-25 13:17:43 UTC2770INData Raw: 10 c0 c2 7d 99 63 4a e4 a6 36 b6 c5 99 2d f4 88 1b 05 a1 18 7e 93 67 a6 59 2b 69 b9 c2 6f 64 d1 54 f3 0d 89 78 3d 80 f0 1b 40 a4 f4 92 5a 94 75 f4 ba ea 56 c5 4d 27 c1 d4 27 7f fb c5 90 d9 82 1f 64 f3 9f 6c 84 92 be c4 ba b9 32 8b 66 cd 17 93 39 35 83 8e 3e 55 cf 01 60 8b dc e2 b3 f3 81 b0 fa 7c 5f b5 84 95 34 53 5b d0 c9 9e 27 dc 9b d3 af 86 f8 ec 69 3b 2e 70 4b e4 8c 95 6b ca d8 f6 19 c1 fa 4b c2 68 21 dd ee d2 f4 82 ba 27 0d c9 5f dc 61 c6 1a 2f 0b 14 f2 14 fc 42 42 f9 27 5a 12 6f c2 7f 86 af 0f a2 eb ad a8 f9 4d cc f7 c2 a2 ff 61 54 b8 38 2f 7e 8a e0 14 9c 25 95 7a 46 ba f0 f4 75 ab 6c 6b 9b d0 2b af cc 94 4a 98 ab e6 0d 10 2c 22 00 ed ef 38 d2 f3 f8 2a 24 c7 cf 00 e8 9b 08 5d a4 60 c9 d2 fc 47 b9 d0 ed 27 c5 27 b2 45 7a a6 c4 ba fc 17 39 f7 70 51 dc
                                                                                        Data Ascii: }cJ6-~gY+iodTx=@ZuVM''dl2f95>U`|_4S['i;.pKkKh!'_a/BB'ZoMaT8/~%zFulk+J,"8*$]`G''Ez9pQ
                                                                                        2022-07-25 13:17:43 UTC2786INData Raw: 09 af aa 0c 90 e0 58 46 fc fa d0 3f 53 aa 1c 4e 13 d0 60 ef 10 78 f9 ea 21 f7 e7 98 8b 3f a3 af 94 7e 57 1e e0 c6 4e 53 50 74 65 71 cf 2f f9 14 ba a8 8f 63 76 19 6c cb e7 f4 31 2f ae 48 22 82 d5 ce bb 45 70 10 78 7f 3d 29 6d 4c 93 42 f1 4b 42 1f a1 bd d2 d0 cd c1 8d 6b 77 97 a2 4a 6e c3 23 f8 5f 3e a3 54 97 d2 c6 27 92 17 26 c8 46 03 d8 fa f5 91 d9 c8 60 ed 4d 96 67 ba b6 40 6f 49 76 1f 83 0f 60 ee c8 38 6c d2 1d 34 78 d8 f1 87 59 10 9e 87 46 29 c8 0a f7 11 a2 2f 06 55 2b 38 62 a1 1c 35 99 cf 78 a0 9c 08 ce 7c 79 9c 43 9f c0 1f ef 61 cf 12 e0 d5 a4 e9 4f c9 51 38 22 28 b5 28 c0 0e b7 7a 9d a0 5b e6 a7 68 f2 5b 3f 15 f7 76 8d f2 ca 02 31 25 a0 3c 7b 07 8a bd ec 38 b0 02 cc eb 1c 1a ca 09 6c 4c 1d 1c db 28 6c 2f d5 37 76 b5 98 7f 57 18 a1 c3 1e 22 46 1e 04
                                                                                        Data Ascii: XF?SN`x!?~WNSPteq/cvl1/H"Epx=)mLBKBkwJn#_>T'&F`Mg@oIv`8l4xYF)/U+8b5x|yCaOQ8"((z[h[?v1%<{8lL(l/7vW"F
                                                                                        2022-07-25 13:17:43 UTC2802INData Raw: 71 ef f7 cc 57 16 7b e7 a4 fe 76 2e 5c d6 82 33 ed 7d 6b 46 89 9f 89 dc e7 75 a7 03 a4 bf 21 c3 d2 a6 93 88 04 2e 1a 8c 1d e0 87 9f 87 54 db 60 89 f3 d5 03 fd 83 a8 7e 17 58 b3 ec da ef e9 06 18 81 7d 4f 03 bd e4 02 3e 76 2e 72 ca 5b 02 19 4e 8b 40 fe b3 4e 63 67 c6 41 a7 08 a9 74 0f fd 33 7c 35 5e a7 9a 02 52 ea 5b 95 0a 95 60 6b 5b 82 4d 96 f0 c2 2d 59 50 79 cb 0a 81 62 fa ad a3 e2 03 b7 54 c0 57 de b6 74 42 86 36 c7 28 32 39 7f 4d d1 60 8c 4d 11 f5 a7 e0 f5 74 5d 2f f8 b1 ef 69 09 b0 16 47 82 4a f0 fc 70 56 94 94 57 99 32 5a 3d 98 a3 6f f5 9e 8c 4e 6d 14 06 fe 12 e9 84 84 82 5a 60 74 c4 bc c0 34 47 45 c8 8f cb 51 05 5e b3 87 01 04 ce be 5a eb cb fd 2a ab 09 eb ce ff 0f f4 11 4e 5b 98 cd 78 d1 4a d7 ef 1c eb 1e 8b 61 82 28 e6 74 a0 7e 39 54 ab c2 7f db
                                                                                        Data Ascii: qW{v.\3}kFu!.T`~X}O>v.r[N@NcgAt3|5^R[`k[M-YPybTWtB6(29M`Mt]/iGJpVW2Z=oNmZ`t4GEQ^Z*N[xJa(t~9T
                                                                                        2022-07-25 13:17:43 UTC2818INData Raw: ec 71 07 3d 78 a8 5e 6b 05 49 83 47 41 b3 5e 85 b7 ca 00 27 1c 90 a0 3c 26 ff f4 50 50 0b 51 6a e9 2a 3e ed e8 1a 83 21 69 dc 0d ca d5 f7 35 b8 dc b8 df 2e a0 db 51 0c 47 d5 5e 5d dc 21 39 a6 6c 98 4c 2f be 82 1c c6 5c dc fc 54 fc 99 96 c1 aa 2a 3e e3 f4 4a c7 a9 9b bc a3 72 a8 1e f6 dc 97 0f 25 6e e8 39 de f3 57 92 58 2f db 64 c7 22 39 73 79 11 09 0d 46 76 cd 59 61 98 75 56 01 53 28 f3 3b 6a a4 3a eb 93 1c 76 ae 41 a5 c9 4b da 36 fd 26 4c b8 91 42 c6 5c 5a a9 e7 4a ed 8f 26 fc d5 cf 65 46 7a 03 cd ab 37 23 33 08 80 83 8c da 30 2d f3 a9 4e ab 27 82 85 e9 04 b6 2a 3f 67 e1 a9 6b cf ed c1 c3 d2 95 5d 47 e5 96 be c5 5e f9 e1 10 80 ce 99 75 5d 46 a7 7b 0b f8 1e 16 ce 81 cc 9a 57 c1 c9 98 a7 86 c6 6e db 63 e2 be 6a 35 b3 6b ed f1 82 f0 42 a8 64 12 f4 e9 5d b9
                                                                                        Data Ascii: q=x^kIGA^'<&PPQj*>!i5.QG^]!9lL/\T*>Jr%n9WX/d"9syFvYauVS(;j:vAK6&LB\ZJ&eFz7#30-N'*?gk]G^u]F{Wncj5kBd]
                                                                                        2022-07-25 13:17:43 UTC2834INData Raw: 00 b2 ef 02 bc d7 59 e1 e3 2a e2 9a d8 77 88 99 79 15 e6 26 0d 72 30 e2 c0 98 5b 40 b1 6f 6c d4 92 17 45 93 73 84 a5 66 ea a0 fe 88 e4 85 3c a4 5c 6c 45 0f 6f eb 76 3e 60 b4 71 85 e4 13 02 75 cb 41 66 22 9e b9 85 c0 3f ec 31 29 3e bb 82 59 6a 42 e5 77 23 41 f6 3d b8 a5 99 57 54 b0 57 10 22 6b 13 6e e0 23 e3 22 0a 61 d5 0d d5 9d 93 6f 9f 39 0a c7 3c bf 99 94 df 73 b1 c5 56 63 fc 34 81 b8 51 ce af 77 e5 a9 fe ae d0 c2 b0 1a 50 1a ca d3 77 48 1c 1a 49 6b 2b b4 32 2c fb 39 81 e1 49 0a 33 8a df 37 4a a1 b4 48 79 12 12 59 85 8b 20 75 3c ea 34 d8 ef e7 32 da b5 28 b2 c6 22 8d 50 c1 b8 eb 6a c2 21 95 76 4a b2 0f 87 49 9d 43 65 a6 76 05 fb 3b 86 b8 31 cb 5c c2 04 12 3f 17 81 b0 8d 83 89 8e 19 c0 4b a5 24 9e f9 1a 73 2c a4 42 ff 19 eb 7d bd 76 b1 a4 26 1d c2 5b 9c
                                                                                        Data Ascii: Y*wy&r0[@olEsf<\lEov>`quAf"?1)>YjBw#A=WTW"kn#"ao9<sVc4QwPwHIk+2,9I37JHyY u<42("Pj!vJICev;1\?K$s,B}v&[
                                                                                        2022-07-25 13:17:43 UTC2850INData Raw: 8c fe 6a fc d7 63 ef 0d 2d 4b e7 fe f5 ed 72 6d cf 69 d0 8e 8c e8 c2 a2 01 1e f8 e9 82 e5 0c 54 bc 43 21 b4 93 cb 12 c0 9c fc 63 0b f0 b1 21 30 65 84 6b 56 a3 08 81 40 e0 89 b8 c7 ac 06 7b 8a 88 ba 6a ba fd d1 54 15 c4 10 8b 98 e5 30 8a 2a 02 7b 19 e5 63 76 9b 5b 43 08 08 12 95 41 f5 45 4b a2 77 fd 44 a7 74 62 a6 a3 0e 1e 2d cb 64 49 9f 31 b9 d5 b8 c1 f6 f9 a1 91 e3 fd 37 f8 08 9e f9 d3 9c d4 fe 58 e0 a9 33 5f 6b 3e 07 f2 0f 66 2f 80 60 12 64 dd a5 1f b6 66 b3 18 ed 9e 96 19 74 ca f3 d1 ff 47 8b 21 06 5f cb 3c 53 1c d2 a4 43 d6 96 04 8e 76 2e da 2a a3 d1 cd b0 0e b9 ec 0e 60 71 b4 cb 60 0a c0 ac 1c 63 6d 88 64 a8 08 01 1d a7 4a b5 44 f3 71 05 55 b7 a8 46 05 b2 e5 7e 1a 31 48 7a 73 d4 e2 af 71 de 99 86 8d 80 60 c1 f4 d8 6e d3 32 96 c0 e6 e6 01 64 68 6d 5e
                                                                                        Data Ascii: jc-KrmiTC!c!0ekV@{jT0*{cv[CAEKwDtb-dI17X3_k>f/`dftG!_<SCv.*`q`cmdJDqUF~1Hzsq`n2dhm^
                                                                                        2022-07-25 13:17:43 UTC2866INData Raw: 88 91 34 b3 db 9a ff 90 a6 84 2d 86 a2 7c c3 f6 1f 36 d3 c3 a1 77 ba c3 6d 74 f7 98 c1 01 b7 d4 b5 fc 61 81 c0 f0 44 40 48 57 6f 68 e8 03 48 13 c4 a4 31 19 19 8d 90 8c e3 48 c5 7f a2 f4 8b 9a 93 7c 00 ef 35 d7 c6 0b e3 a2 69 d7 05 36 64 ad f2 a7 7c d5 35 d3 f7 2a 61 ac 6b 23 1f 19 b4 7a 7d bd a0 d5 65 c6 89 eb 40 cb 90 4a 5a ad 4e 8c 90 30 d3 d2 8b 7d a1 bd c4 ef 24 1f 3d 18 77 11 6d c1 6c f7 e2 18 b1 70 78 70 cd b1 ab 83 8c 4d b8 4d df a7 b0 d1 ca 97 3b ba 61 30 76 12 af b0 4b eb 6c 58 72 1d 09 e5 9d 2a e6 f3 1d 16 6e c4 93 4d 7b 24 ac bf 79 92 c8 0d 35 e4 c7 85 35 66 4c 5b dc da a3 cf 28 87 65 bc ed 8d 8f 5a 65 80 49 84 bd 54 65 8c 84 ca 88 cc 0d 0a 29 9b a2 d4 e2 7e bd 0f 3f 0b 76 82 ec d3 9f 92 21 07 8d d0 1e af 1c 12 38 48 06 6c 29 ba 06 97 c7 8c 3b
                                                                                        Data Ascii: 4-|6wmtaD@HWohH1H|5i6d|5*ak#z}e@JZN0}$=wmlpxpMM;a0vKlXr*nM{$y55fL[(eZeITe)~?v!8Hl);
                                                                                        2022-07-25 13:17:43 UTC2882INData Raw: 45 43 53 9c 99 22 51 1b b1 d9 75 10 f9 44 88 e5 eb 49 ff 6b 63 d6 9a 03 7e e6 82 0f 78 c5 a6 b6 23 0f 8a 9e cb fd d1 5a 29 6b 1f c3 ba 76 49 99 3f e9 c8 aa 5e e0 b5 78 f0 83 74 e0 01 e4 ea 3a cd 00 c4 cc 06 df 8e d9 8e 51 6e 67 35 95 09 8c ad 32 32 55 97 d1 e5 67 76 e1 75 19 7e b2 bc 4d 45 e4 59 1c 2d 79 68 42 53 b4 32 e1 11 6d 99 74 56 07 b9 dd 38 6f df 18 46 a6 6c 6c e3 4b 66 02 fc 04 48 bc ca 96 8c 95 c2 1f d5 93 eb fd 6a 71 51 83 89 63 33 8a 17 f5 07 f6 be 76 79 de 2c 1b 56 18 2f cd c7 1d a3 e0 c1 c5 c6 99 4d 9f df fd 9d 3c e9 67 16 88 aa 3c 65 dc cf 0b e5 fc 67 d5 2f 22 1c 0d b8 29 27 5d 10 31 f0 90 ed ff de be c5 c8 6e b3 cd 07 9a be 3a 79 73 ad ee 5c 17 21 e6 37 ed b2 c4 b2 7e 51 f2 9b 56 47 c0 3f 13 5a 0d 99 0d f6 fd 18 06 c4 db ba ba 92 0b 22 97
                                                                                        Data Ascii: ECS"QuDIkc~x#Z)kvI?^xt:Qng522Ugvu~MEY-yhBS2mtV8oFllKfHjqQc3vy,V/M<g<eg/")']1n:ys\!7~QVG?Z"
                                                                                        2022-07-25 13:17:43 UTC2898INData Raw: 15 ba a2 af e3 e0 a3 06 f7 ae b3 b8 d0 ae 30 60 3b 82 fc 9b 13 27 df 26 6e e4 cf 8e 0a e4 0e 06 f0 19 7b b0 d4 aa fc 99 33 a3 0a 01 1f 48 15 19 04 a3 f2 bc 59 da f2 5a b3 02 5a 10 55 38 25 7a 67 ec d1 92 64 a7 0d 65 79 e5 d8 42 ed 2d b5 dd bc 56 7b 66 8f a0 4f 83 5a 0d c0 fb 17 88 f3 1d 4f 9d 7a b2 d2 d6 fb f9 8b 26 57 ab cb d6 3c 6e 0b 73 60 ce 1f 97 9a 92 93 99 4b f0 09 0d 1e 78 87 f2 cf 02 d0 f9 c4 62 de 87 31 fa 7d 5a e8 33 ed 59 61 83 4c 40 59 73 43 a5 25 8b ca e6 a3 2d aa 42 20 96 18 93 87 e2 f0 4a 20 c7 02 15 d0 c0 12 cb d7 72 29 dd 5c 41 80 a6 1f 06 be 86 22 dd e1 49 a7 d1 94 9f c1 43 62 fb c2 aa 97 8a 8b 81 e2 95 5e e8 b6 db 94 92 fb a7 5d 60 63 c5 96 80 ac 8e f8 b1 63 39 2e cf af 8c 20 e7 35 e6 64 d6 e2 21 d9 88 b4 62 30 24 dc 22 b4 0f 2a 09 78
                                                                                        Data Ascii: 0`;'&n{3HYZZU8%zgdeyB-V{fOZOz&W<ns`Kxb1}Z3YaL@YsC%-B J r)\A"ICb^]`cc9. 5d!b0$"*x
                                                                                        2022-07-25 13:17:43 UTC2914INData Raw: b2 00 8b 9a 86 d1 58 a9 d7 be 9c ad f6 4d 02 90 fe fe 21 01 93 b0 95 c1 21 56 e0 4f 47 82 10 29 e4 1a a2 67 45 e4 2a e7 0d ff 03 9b d3 e2 b2 15 8a 75 a5 eb 1a 09 0d eb 4a e1 e3 28 aa 2c 26 dd d5 a6 1c 87 fd b8 2c 05 40 3c b6 6a 51 51 23 a2 c5 58 da 35 54 5d ec 3b 54 db b0 08 0b a4 e8 25 97 cf 62 5a d4 cd c9 7a d8 9b c1 09 26 0c 3b 90 43 28 4b 39 04 27 3f ef 65 b3 5a c6 d4 ca d4 5e 10 31 02 2b fe ab 3d a0 27 60 25 b4 b4 92 2f d9 ef cc 55 fd 02 e8 f3 85 6e 1d ca 93 7e 25 ee d4 fb 0f 60 7e be b9 ca c6 b5 f4 86 3d 9c 4b a4 94 9b 9a 00 e7 6c de 09 45 cf 22 ba 54 ca eb 98 a3 f2 af ea c6 e9 6e d7 c9 f4 f4 51 ee 70 2b 12 b9 46 c9 f0 2a 75 b0 23 19 11 8d 0a 83 4d 1e bc 5b 1e ff f6 8c 06 64 6d 08 00 3d 7f c4 ee c0 ff 05 5a d7 ac 2d 9b 3a 29 ad ee f0 0c 7d 8f dd b0
                                                                                        Data Ascii: XM!!VOG)gE*uJ(,&,@<jQQ#X5T];T%bZz&;C(K9'?eZ^1+='`%/Un~%`~=KlE"TnQp+F*u#M[dm=Z-:)}
                                                                                        2022-07-25 13:17:43 UTC2930INData Raw: f1 f8 5b 07 54 b5 dc b9 38 f4 66 43 f1 6e 58 e7 a1 95 ec b0 2e 8f b9 b3 c2 cb 48 7e fb e4 5c 3f e8 0b eb 23 25 7b b8 d7 cd e5 d5 dc 79 57 42 8b 15 3e 7a da 41 76 b3 0d 63 ad bd e6 bf 93 f5 ce 30 d8 ea 55 fe 3b d2 6f b7 17 b3 53 39 8e 55 26 00 11 e8 ba c7 ed 25 e3 fa 62 0e c7 57 29 2d ef 65 f5 5e 94 79 3f 25 74 f5 8c b4 85 a0 fb 9f 9b 2a 75 c7 f2 bc d7 ce d7 5a 11 75 68 fd ef fe d0 b0 16 f1 e2 61 60 83 51 f4 bd db 6c 4f a9 82 19 0e 6d 0b 66 ab 8f cf 3a 1e ba 15 54 a3 28 13 45 a4 e0 ff c0 01 f7 61 9b 81 44 83 6d e2 a7 8b c7 11 89 dc f2 aa 30 80 ea 16 a1 31 7a be bc bd 57 77 e3 97 d0 83 13 f4 90 ed b3 bb 2c d8 5a c2 5a 8c 30 9f 1c 1d 41 8f 65 a4 e3 b6 45 35 6c 10 fa af 43 e9 4d a9 e0 88 d3 40 bc 49 17 a8 32 f0 68 72 b8 21 40 3b 11 14 7c 9e fc 64 cf 9f 8a ee
                                                                                        Data Ascii: [T8fCnX.H~\?#%{yWB>zAvc0U;oS9U&%bW)-e^y?%t*uZuha`QlOmf:T(EaDm01zWw,ZZ0AeE5lCM@I2hr!@;|d
                                                                                        2022-07-25 13:17:43 UTC2946INData Raw: 80 09 2e 01 b8 8f 9c 14 67 9c 7a 70 6e 32 cc 9a 48 db a9 e4 63 3e 10 8d 6a e1 ab b5 10 f6 90 e4 27 ad 74 e8 26 a1 66 06 5d 51 b9 4b b4 0a 0e cd 9c 8e e5 00 d3 fe 76 91 62 3e 2d 2e 98 ec b0 69 a8 3c 98 35 ba 9b 6b 62 5d 57 95 69 44 e5 9c d4 c6 86 92 1a 99 d6 37 c5 bb 69 13 2c 15 9a 22 e8 51 7c 49 2f 1b b2 e3 fc c7 e0 4e 2d ab 26 4b a1 1f fb 02 e6 a3 ed b1 2d 4a 2b 52 1e ee c2 a4 96 09 f4 b0 48 55 da 85 5d 34 a1 c7 02 11 27 ad f7 7e bd 82 74 4b 3e 87 b8 97 4d 91 af 71 07 19 59 4f ad 5d 4d 75 9e 2c 6c 01 36 4b 79 b7 73 ac 3d 57 85 64 dd 3f 4b 45 02 f0 e6 2c 0b 1e f6 4b 93 35 c0 54 9b 61 a8 bd 0a 73 92 aa 06 b9 69 25 61 4e 6b 00 43 e2 a3 45 f6 26 78 87 1d 28 fa 3e 80 20 1e 96 85 3f 1c bd 7e 52 66 25 33 5a e2 ba 4e 19 71 19 64 b8 d9 d7 f2 74 42 cf 80 ff c3 60
                                                                                        Data Ascii: .gzpn2Hc>j't&f]QKvb>-.i<5kb]WiD7i,"Q|I/N-&K-J+RHU]4'~tK>MqYO]Mu,l6Kys=Wd?KE,K5Tasi%aNkCE&x(> ?~Rf%3ZNqdtB`
                                                                                        2022-07-25 13:17:43 UTC2962INData Raw: 82 fb d6 a9 43 4c b1 29 bf 49 08 7b 3c 39 55 8b ac 7a ee ab 87 16 51 e3 1a 9d 1b 44 9d a5 5d ba 50 fe 5e 18 7e 7e 95 7c be 2b b8 42 77 65 15 3c 7e 29 53 5b bd 1b be 86 49 08 66 0d a2 8e 4d e0 9e 5b 9e dd 6e 0e bc 24 85 4d 3a 88 2a d1 eb a8 17 41 aa 5c a0 b1 08 ae 04 f5 8b cf 7d e3 1b 33 79 25 fd ce eb d6 da bd 1e dd 5f 67 db ce 3d cc 61 bd 09 01 f0 0f a0 59 64 ac f4 c5 b4 88 8b 6a 85 98 25 2c e4 e6 2e ea 77 aa 3d 68 3a 67 40 de c7 1e 9b 0b 51 8e a3 fb d0 8b 45 64 4c ed 58 a4 37 bc ce 40 dc 75 86 a5 79 9a 30 ae 38 72 07 cb 4e 7e 53 73 3f 9e a3 92 19 23 6d 26 be 3d 0d 73 2a a3 29 3c 1e c8 74 91 17 21 ed da d0 44 44 1f 1f 14 98 da 14 a2 2a c2 e6 29 6e ef 73 f7 69 4e c6 0c 71 1e d6 a7 4f 6a dc 2e df 34 8d c8 16 d2 1b 0b 3a d6 25 32 38 30 a4 bd dc 6b b4 30 95
                                                                                        Data Ascii: CL)I{<9UzQD]P^~~|+Bwe<~)S[IfM[n$M:*A\}3y%_g=aYdj%,.w=h:g@QEdLX7@uy08rN~Ss?#m&=s*)<t!DD*)nsiNqOj.4:%280k0
                                                                                        2022-07-25 13:17:43 UTC2978INData Raw: e9 ad 53 6e 60 22 44 15 3e d0 59 31 9e 72 25 f8 f6 7b 60 de a8 00 0e 6b 81 c4 cc 40 5b d6 22 4a 85 fe 5d 4b 2c 3a 65 01 11 ad 7a 40 df 9e 12 bb 5f 49 bf d6 7e 32 88 9c b2 c2 ae 3d fd 45 c5 13 63 09 66 c8 98 07 6c 1e 6c 8b e5 4a 7a d0 49 62 55 b4 e8 f5 8f be 8d 95 67 e9 c2 89 19 19 79 24 4a 84 1d 77 20 65 0b 48 05 b6 d5 92 66 8c d0 33 0e ff f3 db f1 4f de d4 d9 f7 2b 35 ca 4e a6 a7 47 6b ad f6 c9 a0 64 f6 37 81 42 e4 0e 56 5e c0 d2 38 15 55 c2 6f 1c 91 e3 55 af 7d c7 91 8e 63 89 9c 21 03 7e 3e a9 34 16 02 7c d9 90 bf 9f da 36 b1 aa b5 84 c6 96 c1 3d 60 e2 3e 16 bc c1 77 7d 17 51 41 eb 09 e1 0d 2d 58 05 10 1c a6 3d 69 18 3e 68 66 bf 01 8b f3 61 c5 1b d0 27 4d 98 d0 6c a3 1d 26 86 90 5c 70 38 b8 af 3b 62 47 cc 57 02 d9 aa ef 11 e2 01 1a 6c 6a ad 59 8d d7 83
                                                                                        Data Ascii: Sn`"D>Y1r%{`k@["J]K,:ez@_I~2=EcfllJzIbUgy$Jw eHf3O+5NGkd7BV^8UoU}c!~>4|6=`>w}QA-X=i>hfa'Ml&\p8;bGWljY
                                                                                        2022-07-25 13:17:43 UTC2994INData Raw: 46 26 e4 87 c6 2c 06 e7 09 b5 a3 11 68 bf 93 11 da b5 d6 d1 99 58 cb de ef 63 e8 de 46 6b ae 9a 50 a2 70 5e 16 dd c5 36 a2 4b e1 a3 da 35 8d 1b cd 49 01 8e e7 fd 4a a3 9f 2d 53 2d f0 43 f0 53 02 6b eb a7 de de 54 2b 78 56 bd 85 cf 59 93 31 d0 8c 42 50 3a 83 e4 b6 b0 42 f1 be 44 23 a9 a9 9a 42 ef 78 cc fd 37 85 57 13 8e c4 95 ab 87 d3 5a 49 41 1e 18 f1 cc eb 5e 5e 9a ce 4b 41 47 c0 6e c3 d3 a3 a0 fc 05 c9 8e 42 36 4f b7 b0 3f f2 a9 44 cf e5 46 d5 64 42 fe 79 71 1b c9 8d 98 53 c3 26 11 26 8b ed b5 57 df ec 59 b0 79 50 c2 2e 88 58 57 37 ef 83 9c 5c 27 7b 1a f0 dd b3 31 31 de 6f eb 88 1b ef 57 7d 1d 1f 84 67 5c b9 02 52 b9 3b c2 90 43 b9 d8 cf d1 4b 6a 2f 59 12 1c bc 93 9b cf 03 bf 0b ee 8f 08 6f 14 bd eb ae c5 26 9e bb f0 5e 09 ff 48 fe 2e c6 1b 9a 37 0a be
                                                                                        Data Ascii: F&,hXcFkPp^6K5IJ-S-CSkT+xVY1BP:BD#Bx7WZIA^^KAGnB6O?DFdByqS&&WYyP.XW7\'{11oW}g\R;CKj/Yo&^H.7
                                                                                        2022-07-25 13:17:43 UTC3010INData Raw: e6 db b8 65 f6 fb 00 73 51 63 d4 ad 47 0b 8b 88 fe 64 0f dc bf c2 a6 7d c5 43 09 9a a8 17 11 cf 72 5a 6d c1 02 23 51 e8 57 4a ed d0 35 0c 4c 34 30 8f 06 23 d6 ee d2 eb c0 17 1a 45 f2 22 9c 0b f3 05 dd 33 18 68 30 fa fd 43 2d 54 40 d7 a3 31 19 6f 50 b1 13 77 a2 67 98 99 77 c0 d2 38 21 28 0a 68 bc e3 89 02 3f 19 7e 56 9f 20 8e f4 bf af 30 82 a2 71 87 cb f9 66 8c b1 f2 de f7 d3 9d 69 79 1b 7b c7 d2 4a 80 06 a4 d9 22 6f e6 fb 2a ed c5 8f 76 bc 20 dc ac f7 bc 75 be 63 9a 91 ac 1e 1a 1e d2 3f 25 09 a6 bc f5 92 0b d1 34 2a fb 33 ca bd 32 64 61 4f bf f2 b7 4c aa b6 29 d6 0b 2b 93 ac bf 08 80 9e 40 40 2a 8e de b5 1a 8a af b5 04 4d 14 6b 67 3a c5 e4 d5 9f 90 7d 55 d7 62 e2 5e c8 cc 43 b5 09 5a 28 24 3f 9c c3 7c ca 70 1f b2 b8 e2 8a 59 9c a4 86 d7 70 14 04 35 a4 84
                                                                                        Data Ascii: esQcGd}CrZm#QWJ5L40#E"3h0C-T@1oPwgw8!(h?~V 0qfiy{J"o*v uc?%4*32daOL)+@@*Mkg:}Ub^CZ($?|pYp5
                                                                                        2022-07-25 13:17:43 UTC3026INData Raw: d9 bf 98 2f 98 6a 4b 5d 32 11 37 e6 62 75 ad bd ac d2 03 fe b6 87 0d c1 e7 81 93 8f f5 10 b9 d1 86 97 40 51 c8 ad 2d 11 4e bb 00 33 1d ac f3 e7 21 0a dd b8 6b d6 85 70 a9 1b 09 76 90 49 b3 9b 62 3b 33 dc 17 c4 80 de bb 6b 3b 4e ef 01 44 b4 3d 3c ff 0b db 87 45 38 a7 0d 64 08 a7 b6 3f 35 ae b9 37 1a 6a ff 2a 75 3b eb 30 d8 f7 0e 70 06 47 6f 74 17 d6 14 bc 34 91 99 71 7c 31 49 01 d6 5e dd e0 6d 6f 85 83 fb 65 3e 12 9a 2f 9d 0a 95 7f e1 fa 42 a9 52 a4 83 4c d6 7a 5f 8d 72 8b 28 05 24 78 01 06 74 21 e7 0f 5b 5b a5 b4 97 c6 75 22 9d b6 38 d4 c0 bb cf 9e 47 77 d3 e5 53 dc a0 e3 12 17 96 f2 d7 15 f8 5c ec 4a 25 54 57 ed b6 1d 0c 0f 3b 7d 7a 33 c7 a2 77 93 e7 d6 96 56 0b 8f 67 56 69 92 ea 51 b7 61 d6 6a 16 60 c6 2b a8 12 d4 6b f5 89 d9 04 3a a1 1f 28 f4 93 dc 04
                                                                                        Data Ascii: /jK]27bu@Q-N3!kpvIb;3k;ND=<E8d?57j*u;0pGot4q|1I^moe>/BRLz_r($xt![[u"8GwS\J%TW;}z3wVgViQaj`+k:(
                                                                                        2022-07-25 13:17:43 UTC3042INData Raw: c2 d5 48 da 8b 75 03 f8 59 0b 1d 41 cf 24 85 5a 56 8f c0 06 05 95 4e 8e 15 5b 05 79 c2 e5 05 f9 13 f9 7c d3 1d d4 c3 90 37 e7 6c ef 31 d1 42 fd 37 82 c1 3c df 7f b4 c9 b4 06 73 40 22 a6 0c b7 2d 53 17 9b 21 36 e5 e6 d5 e1 c4 07 33 69 c3 75 5e 55 c5 ac 78 5c cd 10 e5 c7 03 ee 0e 58 2a fb 58 c9 ab 38 92 b4 14 09 65 f8 21 d2 10 06 68 38 99 e2 9a 66 05 e8 bf c1 61 a0 17 68 01 ec 5e 08 78 24 f7 0e ef 3e c8 c6 ac f6 b8 a3 f3 ad 91 49 c3 69 61 dc eb 71 58 03 be a4 c9 11 7e 7c 8c f3 32 e4 5d 81 db 52 89 28 d1 71 38 85 a9 10 d6 9c 39 db d5 94 e1 a0 d2 1b ee 2d ab 8c 47 fe 54 1d 96 9e df 14 99 41 3c 39 60 49 4a e8 de 1b 4d ce fd a6 d3 6d 41 4a 7e 3e 2e 41 67 8d 61 f3 0f 56 ee 51 9b 98 7b 22 91 b0 64 ba 7f 4a 50 e3 61 50 41 fa de ee e9 50 c6 8f b9 cc 85 6c 5d e7 c8
                                                                                        Data Ascii: HuYA$ZVN[y|7l1B7<s@"-S!63iu^Ux\X*X8e!h8fah^x$>IiaqX~|2]R(q89-GTA<9`IJMmAJ~>.AgaVQ{"dJPaPAPl]
                                                                                        2022-07-25 13:17:44 UTC3058INData Raw: ab 1e 7e 42 13 48 1e b7 57 57 3b 17 c5 a5 ea 57 44 78 23 05 03 2a 7d 9d 0e 6c bb 55 fd 50 b4 6c 1e 11 9d d0 19 87 31 84 4d 6a aa f5 16 60 8b 74 0e 18 56 a6 12 21 16 b4 e7 58 e2 85 25 fb 98 56 3f aa 00 dc fa 37 05 2c d0 f2 13 d6 50 1a 11 a7 d5 ef e2 ed 6c ae 98 ea de c0 87 09 cb 8d 3d 0b 58 64 3a 66 58 cc bb a2 b8 a2 3c fa c2 80 52 f6 30 c1 f8 0a 36 33 30 ce 97 55 21 35 b1 83 2c 6e 47 4b 29 67 cd 25 4a 7a 65 91 a3 48 97 e6 75 69 51 5f d3 11 d1 34 36 80 f7 3d 8b 38 3f 4d a1 c9 77 ae 76 74 48 f0 6d 31 50 64 69 7a 3a 10 30 d8 4c ce a8 7d b9 d7 70 3f eb f5 16 d8 d9 26 9a 90 48 5d 3f 69 cf ae 33 45 ad 2a 51 55 fa 1c 8f d0 59 7a f2 e6 f8 35 18 51 e9 7a e2 7e f0 4e 3a dd a8 bc 1a 0a 8c a8 0b 89 16 c7 db d3 32 13 e8 d3 03 8b f2 e3 f3 f2 fd bb 31 e7 75 a2 e4 97 67
                                                                                        Data Ascii: ~BHWW;WDx#*}lUPl1Mj`tV!X%V?7,Pl=Xd:fX<R0630U!5,nGK)g%JzeHuiQ_46=8?MwvtHm1Pdiz:0L}p?&H]?i3E*QUYz5Qz~N:21ug
                                                                                        2022-07-25 13:17:44 UTC3074INData Raw: 7e 77 a3 ce 2a 4a 14 10 2d 70 98 11 6b 59 63 08 e4 2d 5e c3 a9 6b 93 89 66 e1 1d 7c 4a b3 29 ce 70 4e 4e 70 95 20 b6 df b6 82 f2 26 f3 e4 0e 4f 62 3b 97 67 b0 93 be 11 70 c6 38 14 cb 07 ae a7 00 51 7a 22 94 98 46 ff 79 1a fa 01 c6 3d b7 d6 c9 41 65 c8 8b 75 19 9b 24 f8 5d f1 0f 12 9d 56 8a 19 94 e4 a5 95 c5 7d d4 d6 a2 19 a3 1e bf 96 ae 42 e2 93 64 1a 5b 73 d2 a8 3f f0 a1 69 3a b0 0c 02 08 57 a9 ab bc 14 22 ec e1 f3 68 fc 3c 62 03 e5 28 0d e0 b4 b6 b3 33 86 88 20 f4 9b be e9 6d ec 8f c2 bb 03 62 b9 d0 b0 56 0b 39 06 1b 69 a8 12 87 4d 6a ac d5 54 55 1a 5d 77 04 6b 5d 71 ff 43 71 6d ca 68 2a 70 df 8c bf 47 63 89 e2 a7 fb 0a 59 ee ad 25 49 6c 95 d2 e8 53 8a ca 53 a3 39 4d fd 8b 91 ec 30 00 61 0a a1 f5 89 df 1e 6f f5 f3 60 31 7e b0 3c 78 10 9f 36 23 bc 67 e2
                                                                                        Data Ascii: ~w*J-pkYc-^kf|J)pNNp &Ob;gp8Qz"Fy=Aeu$]V}Bd[s?i:W"h<b(3 mbV9iMjTU]wk]qCqmh*pGcY%IlSS9M0ao`1~<x6#g
                                                                                        2022-07-25 13:17:44 UTC3090INData Raw: 18 02 40 94 49 c3 f0 e6 5e 73 1e 43 c3 16 f3 f9 a4 b6 c2 11 f5 56 60 3f 1e 3c c6 28 43 99 fe e8 ed af 4c 70 10 6b 4d c8 ca 95 3e fc af d1 cd 70 d3 9d 58 6b 2b 92 a9 ae 7d 96 3d 12 5a 47 e6 41 07 6f 95 14 e2 ae a5 a4 02 e9 ca 6f 72 9f 8b 9c a8 c2 5a 4f ef f3 3f 65 05 91 fd 4c 97 70 a6 18 16 73 05 b3 1b f3 10 21 06 5c d9 a7 d3 c7 e4 72 ba 53 6d 15 c0 4f 64 82 8e c9 8e 20 0a 6f 5b d7 31 56 80 73 b8 f1 e2 4f ad 4d cf 98 58 ef b9 ec 6a 17 fd 9f d8 cf 8c 47 b1 a2 4e b9 70 2e 82 6e 88 95 bd 73 94 d3 a3 5f 0c 8a 14 7d 4d 1d 62 4d 79 7c b9 fc c7 a3 e1 72 4a 1c 12 1a 16 ac f2 e5 b7 c4 48 c4 13 d2 bf b2 0d 54 df 35 a3 ac 27 ac 47 7e ca 50 31 01 fb be 28 9e 71 64 29 a4 3e 0c 00 ee a0 1e 3c b6 37 c1 be 37 49 0b 26 c1 64 92 7c 70 4e d4 30 d1 22 80 e1 84 38 31 24 d1 81
                                                                                        Data Ascii: @I^sCV`?<(CLpkM>pXk+}=ZGAoorZO?eLps!\rSmOd o[1VsOMXjGNp.ns_}MbMy|rJHT5'G~P1(qd)><77I&d|pN0"81$
                                                                                        2022-07-25 13:17:44 UTC3106INData Raw: 75 12 6a e2 bb 01 07 15 d7 f7 17 60 7e a4 91 5f bf e4 9d e9 e2 2e 47 4a 01 87 98 8a 86 36 de 86 48 81 64 f3 cd db e0 4e 3d aa 23 8e 8e 91 5d b1 03 3c 83 e2 e5 cd de ac b5 ea 65 1e 7a 3b b4 57 f3 30 6f a9 3b e0 5c e6 a1 af 4d 69 aa de 8d c7 a9 8c 3b ae 22 b7 54 14 3b 51 f7 f8 d5 45 b1 3c ec 5f c9 d9 91 02 39 d9 95 5f 9a ba 50 b2 9c ae 9b 9a be d7 dd e8 a4 04 90 40 46 8a da 56 ed bc fd 5f 3d 15 d6 61 a3 93 38 5b 31 95 8a 40 b9 51 7d 57 1e 2c f6 7e 11 70 af 64 65 b1 93 61 a1 51 a3 90 38 96 2b 8b e0 78 25 26 15 2d bd f7 84 a1 71 10 ec 02 dd ad 37 33 3c 7f 3a 76 70 d9 fb e2 b1 b4 ab a5 0d 39 4f 61 d6 74 83 c7 9f cb e1 ab ad 1a 64 42 3f 27 6a 6f e0 6d 29 2f bf 5d 1d 48 e0 e8 5e 17 fc 8a 85 bd c1 67 93 bf 17 3e 51 19 1f 12 9b 19 c2 98 ce 53 59 71 05 d5 0b fd ef
                                                                                        Data Ascii: uj`~_.GJ6HdN=#]<ez;W0o;\Mi;"T;QE<_9_P@FV_=a8[1@Q}W,~pdeaQ8+x%&-q73<:vp9OatdB?'jom)/]H^g>QSYq
                                                                                        2022-07-25 13:17:44 UTC3122INData Raw: 3c 2b 4c 19 39 7b 19 48 02 0c 01 70 32 4e ba 6e 97 85 fe 4b 62 6d e3 d0 70 cd b7 79 03 36 97 6b 7c 45 43 1b b7 8f e7 a6 2b 57 bc 77 b2 ed d5 90 fb 5f 14 62 32 2a 8b 61 09 5f 5b 89 67 8a 2f 31 e7 57 d8 b1 c8 bf e9 54 01 f6 50 e6 00 dc ba e7 d5 6c 9c f0 f7 db 7b fc c7 4f 75 76 a5 bd 43 a7 40 63 a0 55 a4 02 97 54 1e 99 1e 05 7e a7 7d f8 d7 24 ed 6a 6c 8d 27 53 e8 8f 4f d7 18 08 bb f4 d6 2d 7d af 60 3e aa 92 84 bb 48 12 2a 98 b2 be b5 92 26 e6 ed b9 00 b0 db ee 82 a8 86 d2 a0 a8 ba 68 59 48 45 24 4d c8 dc fb 00 8a ed 69 ab 43 c3 6b 2f 0c 4d 08 28 ea 8b c7 0d 5e 34 7a 51 ad 36 fe 37 9e 99 ea 6b 2c 25 6d d5 9c 67 13 1f b0 2a df 6f 06 61 15 fb ff 91 57 3f 74 79 0d 15 7f 58 58 7d 1f 79 6a c9 7a 1d f2 d0 85 7c 73 67 f3 ac c3 aa 0f b8 e9 86 63 14 a1 ee 4b be 0d b2
                                                                                        Data Ascii: <+L9{Hp2NnKbmpy6k|EC+Ww_b2*a_[g/1WTPl{OuvC@cUT~}$jl'SO-}`>H*&hYHE$MiCk/M(^4zQ67k,%mg*oaW?tyXX}yjz|sgcK
                                                                                        2022-07-25 13:17:44 UTC3138INData Raw: 25 6c 55 f4 0a 32 5b f8 7b 73 9a 16 85 04 85 0d 98 35 e8 cf ed 3f 24 f6 51 be 56 b1 b2 28 b2 92 37 ef f7 20 1c 7c 73 ec c2 0e c7 75 d5 9e 93 3f e2 aa 49 d4 21 32 52 f6 78 c3 26 ae ce 32 cf da 1e 27 a0 27 8d a9 fd eb 2e aa 61 c7 c5 24 4d 8a ae e7 c8 e9 1a 15 30 2d 29 5c e2 85 7b 16 19 af 62 89 dc e0 6f a6 8f 81 1b fa cc 5b 40 93 b1 24 58 f7 21 48 96 c7 e3 03 50 83 fc c2 0c 45 f9 9c 30 55 22 96 e8 b2 0b 7d 29 e1 83 2c 65 c4 da dd 06 2e 62 1e 71 c9 a9 2d a1 51 9d 24 6b ec 43 55 de 0c 63 9d 76 2d 7f 15 6d 7e 56 08 60 ca 0c 42 0c 29 c0 a8 f3 07 1b 5c 59 db 6a fa 80 01 af 38 e3 b0 a0 f1 9c 8c 18 98 fc 86 9d f5 3a 40 b3 6a 58 ce cf 2c 0e 2d 82 23 6d 9e 22 38 9d ac 94 a1 32 61 08 f0 94 d2 df b4 4a 52 7b 1e ea fb 5f e5 09 7e df 38 e9 1a 3a c3 5f 81 81 21 f7 bc e5
                                                                                        Data Ascii: %lU2[{s5?$QV(7 |su?I!2Rx&2''.a$M0-)\{bo[@$X!HPE0U"}),e.bq-Q$kCUcv-m~V`B)\Yj8:@jX,-#m"82aJR{_~8:_!
                                                                                        2022-07-25 13:17:44 UTC3154INData Raw: da 2b 33 ad 63 4e c7 f0 b0 e9 60 4f f5 44 c2 e8 2b e0 9e a8 36 66 27 47 34 3c 80 38 6c cf f3 8c 9c d4 f1 cc 40 b2 20 c8 ca 0f 19 ae 63 eb ad 93 20 55 1d 42 fe ad 0a 3b fd 5c 4d b7 e1 8b ab a2 b1 ca 32 d4 8e 33 dd 0d d2 4d b6 db ae e4 0d 0b d6 43 c9 52 bd 32 a8 3f 8c e9 e6 58 ac 41 51 c9 fe 0b f1 26 55 9e e6 a8 7d 46 e9 e2 14 da 9d c7 f1 b5 80 67 a6 c2 ca 0e 31 cf 40 2f eb f5 1e ea 0f c2 62 08 2a 13 2c 57 12 01 47 a5 03 29 84 d3 f8 bd f3 c0 f0 f9 87 3a 80 03 10 f6 3c bb 7f 16 38 25 01 23 64 f9 1a 78 0f 56 d2 c9 90 73 b6 ff fd 18 91 4f 50 ab b8 3c e3 95 37 31 b9 e1 ff de a3 5d 9f 91 2e c3 35 da d7 aa e8 2f 65 c7 04 2b cf 20 7a 11 29 98 8b 57 98 07 ab ea b4 08 4f 14 9d 33 2d 5e 6d 37 f5 49 f9 d2 9b 82 24 df db 77 05 6c fa ad 97 e0 ac d8 07 1e 94 61 7b 2d 02
                                                                                        Data Ascii: +3cN`OD+6f'G4<8l@ c UB;\M23MCR2?XAQ&U}Fg1@/b*,WG):<8%#dxVsOP<71].5/e+ z)WO3-^m7I$wla{-
                                                                                        2022-07-25 13:17:44 UTC3170INData Raw: 49 16 3b ec d6 46 f7 1c e3 5f 4f eb ab 05 0f df 4a 4a 6c 12 a9 c5 d3 0c 77 ba c4 a2 b1 1c 66 38 df 86 6e b7 d5 9b 8a 69 53 16 45 13 06 97 55 9c e4 c9 55 fa 2f b3 c4 19 e1 52 a2 76 79 07 64 0c af 90 78 84 d1 d9 d3 76 1a 7e 3e ca a0 02 38 29 a1 67 22 b4 f8 9b 50 41 7d fd 3e 3a 92 83 6d a9 0c bb f8 87 7c fd 07 10 9d ba 3c cd 8d 9b 07 23 cc 9e 4e 11 8f 25 84 5d b6 ec b0 3e 48 f8 46 81 91 47 ba 51 e8 02 1c 9b c0 18 f5 a5 36 67 e0 50 03 5a 0f f2 bd 79 15 90 9b ba da d3 2e 9a c5 ec 1b b2 4e b5 00 35 96 ec 24 55 f1 e8 35 37 e5 2f 9e cc 20 77 0a 21 74 6b 00 f5 6a 5f 6e 48 68 82 06 3b b9 8b 6c 4d 68 c9 5c 4c 2d 93 a2 15 b7 74 42 67 3a e4 e9 be 87 ca 6d b5 e2 c7 38 ec f6 ba 6b 8d c1 37 f3 91 ef 70 e9 89 cc 1b ff 98 9d 7a 95 d3 9e b2 b0 be 99 ee 08 94 8b b4 68 c4 c4
                                                                                        Data Ascii: I;F_OJJlwf8niSEUU/Rvydxv~>8)g"PA}>:m|<#N%]>HFGQ6gPZy.N5$U57/ w!tkj_nHh;lMh\L-tBg:m8k7pzh
                                                                                        2022-07-25 13:17:44 UTC3186INData Raw: 62 31 b4 a4 69 69 e8 ed ee ed 72 79 0c 95 c8 63 56 89 20 bf 46 75 b6 b7 a0 52 39 22 6f 77 fe 59 0d da 6a 60 d4 e8 f9 cd d0 74 d5 78 8a e5 e8 d5 b4 40 a7 a4 32 27 2f b8 77 8f 46 dc f2 83 65 b6 65 96 2c 2c 49 85 15 b1 ac 4d 84 15 b6 2e 68 a8 69 b4 d7 70 ad 70 3b 23 9e a2 17 d6 2a 30 23 45 b2 6f 9f 80 0f 18 b5 62 27 e4 c5 71 39 74 8d 7f 7a 2a 03 7b f2 ba 5d 75 fd a7 c2 84 2c 87 2e fd 7d 35 e2 30 fc d8 ed 8a 27 18 e9 45 75 cf 6a 6d 7e ab 1f 5b 02 7c b5 78 54 0a 7d ab a5 de 8c 27 32 3c 8c 20 02 87 77 36 19 5d 46 b6 1f 20 95 3b 10 46 0b 59 2e 49 9a b8 4c df 07 ae 4e ee 94 cd 56 cb a8 30 d3 4c 04 3a 54 e1 bd 50 fe 3a 69 fc fe 6c 36 44 c4 cf b7 5b a3 4d f1 67 40 be fa e1 ec a5 66 cb 96 79 c5 91 27 c3 0d d4 3d 4a 05 62 2c 85 30 ce bc 3c d8 e0 21 39 84 b3 da 0e ab
                                                                                        Data Ascii: b1iirycV FuR9"owYj`tx@2'/wFee,,IM.hipp;#*0#Eob'q9tz*{]u,.}50'Eujm~[|xT}'2< w6]F ;FY.ILNV0L:TP:il6D[Mg@fy'=Jb,0<!9
                                                                                        2022-07-25 13:17:44 UTC3202INData Raw: fe 42 cf 8a 49 35 97 29 18 ef 6b 8c ef 88 89 a8 17 73 32 65 b1 19 ad 23 46 31 c8 7f 11 c3 60 9e a2 34 96 2f 26 a6 08 50 b7 8e de ed 0e b9 de 1b 81 2f ec 78 42 c2 3c b2 95 e3 54 da 24 b3 bf c5 ee 62 50 15 ce a5 97 75 36 61 e5 c4 1a 40 a0 76 01 a1 01 3c a1 10 a4 fc 2a fd 6e fd a7 0e 16 dd 0a d1 b3 2e fe 0c 86 04 25 3a 8d 34 46 42 bd 3e 30 3f 94 da fe ee b4 aa 44 80 89 15 a5 c0 72 63 10 be 14 09 11 14 88 b3 d3 98 7b 7f a9 94 76 f9 ca 54 fa 93 eb 0c 5d be 2f a1 79 d6 36 48 61 2b c0 40 3c 8d 97 36 5f 90 70 20 e6 f9 bf 8e 5e 07 59 ce 8b a6 8e 5a ea 17 98 cb 99 e0 e2 f6 6b 32 03 5b d2 29 8e af 51 1f c1 58 8e 12 b9 30 81 88 a0 6f 3a ff 8c 7c c8 d8 be 3e d6 ad dc 13 d8 cf 3c 16 a3 a4 16 9c 91 a6 2d 4e 4c 54 c3 ae 5f 34 24 97 50 e2 ea f5 19 c5 55 da 02 b5 94 48 b4
                                                                                        Data Ascii: BI5)ks2e#F1`4/&P/xB<T$bPu6a@v<*n.%:4FB>0?Drc{vT]/y6Ha+@<6_p ^YZk2[)QX0o:|><-NLT_4$PUH
                                                                                        2022-07-25 13:17:44 UTC3218INData Raw: e1 ad f2 42 7d 9a 2e f2 c5 98 27 b8 5e 14 7f c0 1c 03 e0 9f b1 68 89 e4 09 86 5a 00 61 a0 d1 b6 ed 6f ac 9e 0a 8e 58 1e 26 9b c4 b2 e3 20 75 a2 f8 df 40 ca 13 df db bf db c0 af 5c c0 42 f7 91 d1 09 5d 65 55 36 f9 c6 21 5f 56 6b 4d 07 f2 e2 dd f3 41 c2 17 a3 34 09 57 04 9a f8 7c 68 21 71 29 d1 ca aa 47 39 36 da 41 d0 6c c7 fb c3 b3 f6 a3 bd d0 d3 a3 78 60 d6 a2 a1 cc 45 5d fe 0a f7 72 42 07 ea 50 0b f9 70 cf 3e 85 78 47 7a 92 1c 7d c1 b6 d7 95 75 b4 7b 4b 9e d1 18 b8 27 ad df 7f 5d 35 0c e8 a0 37 30 60 e0 13 a2 da b0 63 3d 03 0c f8 8e 5a b8 b0 57 41 e8 93 64 d6 cc c3 b5 8c 5b f8 a3 9b 35 62 ec 68 1c 5f 49 a7 33 3c 65 74 0e f3 a6 c9 32 cb 54 b4 14 62 dc bd 36 46 61 27 e4 15 2f 00 8d 90 c6 6a b3 5e 07 a5 d3 d1 9d ac 2a ba 46 c7 50 72 1e 6c b8 73 63 87 3b 01
                                                                                        Data Ascii: B}.'^hZaoX& u@\B]eU6!_VkMA4W|h!q)G96Alx`E]rBPp>xGz}u{K']570`c=ZWAd[5bh_I3<et2Tb6Fa'/j^*FPrlsc;
                                                                                        2022-07-25 13:17:44 UTC3234INData Raw: 66 f6 bd ba a8 0d 89 41 77 36 1f 2b e3 e4 77 cb 9f e5 f6 27 74 ad e5 8f c9 68 4e d6 fc 18 cb 6c 68 23 c7 fd 8a 2f bd 28 5b b9 85 44 0c 3d 63 ce 34 c0 34 2a 83 9f 73 28 78 16 93 76 b9 06 3a fb b8 82 90 7d d4 0d 93 74 3b eb a9 77 f3 57 8f 26 da 1b 85 2c be 2b f3 0b e7 21 0c 22 4c c5 e2 1c 29 ed 2d cb 42 a6 9b ae 10 fb cd 98 89 07 9e 57 a8 f1 dd 8c 34 48 4a bd f2 38 e5 36 48 ac 63 ae 6a 29 86 5d 04 b5 73 c8 8a 5d cb 49 5a db 4a 74 b6 26 96 d2 d9 ab 84 a1 02 76 fb ce 29 99 47 cb 01 48 f8 c6 26 dc c4 02 de a3 c1 d3 b3 82 ea 2c 06 a4 6d 30 16 94 54 23 03 89 8f 42 6d c9 05 da 86 3d 7e d9 6b a6 3d 88 78 a6 e6 70 e2 ac ad 70 a9 bb ba 1e 44 a6 45 6d b3 c6 5c d4 34 d4 82 e7 21 98 9f 0c 62 d7 ad 11 ac 55 54 49 ec de e1 14 7c 59 20 87 d6 36 e9 7a cc 6c 59 23 a9 f3 82
                                                                                        Data Ascii: fAw6+w'thNlh#/([D=c44*s(xv:}t;wW&,+!"L)-BW4HJ86Hcj)]s]IZJt&v)GH&,m0T#Bm=~k=xppDEm\4!bUTI|Y 6zlY#
                                                                                        2022-07-25 13:17:44 UTC3250INData Raw: ea 0a 09 3c 3b cf 5f 4b d6 7c 6d 56 34 bb d2 dc 45 4d 3d ed cf 10 9a 9e 87 25 75 9a 43 c1 f6 71 53 b0 a3 28 f7 99 41 88 e3 9c 2b a2 66 9a 75 51 9f cc 1a cb 56 51 66 ee c3 5f 40 6c 09 a6 1d ff dc 25 e5 df 89 b7 24 12 18 d4 f2 46 38 5d 8b 93 7f 22 86 7d 7f 96 f6 4a ea fb dc d5 82 e0 8b fa e9 42 2e 64 1c d5 95 18 6a fd 74 2e 16 5e 0f 45 79 61 6c 6c 7c b3 32 49 6d 9c 0e e6 11 56 ca 5c 56 77 7e 29 8d 39 6a ee 54 42 aa c0 12 b9 5d 8c ef fa ad 68 8d 1d a9 9a b6 02 ef bd 65 56 49 69 ae 36 52 a4 14 ad 59 da d1 50 a6 02 11 22 66 00 99 88 41 78 7d 61 e7 1e 38 33 5c 68 a9 80 76 95 2b d1 90 f0 d9 d3 2d 23 ce 40 47 d5 3d 54 b1 74 d8 c1 8d a9 88 ad 85 c9 eb f5 ad 97 57 1c 8c 9f bc d3 7d ad b4 3b 21 12 53 08 e4 43 5b a0 2c 56 30 e9 9b dd d0 93 f2 12 34 47 cf 94 fe e6 36
                                                                                        Data Ascii: <;_K|mV4EM=%uCqS(A+fuQVQf_@l%$F8]"}JB.djt.^Eyall|2ImV\Vw~)9jTB]heVIi6RYP"fAx}a83\hv+-#@G=TtW};!SC[,V04G6
                                                                                        2022-07-25 13:17:44 UTC3266INData Raw: d3 24 a4 5e 09 84 0e 40 3f 2c e2 c6 a3 a5 cf 8a 58 e9 7b c8 d9 25 1f eb a2 f6 b5 0e ea 8a 35 08 79 0c f9 af 62 7e ae 02 04 5c 19 c3 64 98 a3 a2 6a 84 49 df 2e 97 b3 d0 9c 67 8c 70 f6 bc 6b a3 b5 e1 27 99 e4 c6 e1 47 26 9b 01 ec 8a 35 14 f9 2a 8e ab e5 9b 2a c6 12 d7 62 d9 15 44 f8 4c 37 2c 35 26 20 6e a3 d0 a2 72 ec 73 6b 17 01 46 68 30 77 0b 56 f5 01 75 68 ec a0 f1 16 71 e8 c6 54 77 c4 da 80 0a 12 a1 a8 88 c4 b0 28 42 de 2b 8c 5b 13 74 a4 a4 6e 5b 59 f3 98 c7 98 08 2d 13 8e bb 81 c9 2a 58 fb c5 d9 93 8e d6 69 3d 55 ee 3a de f3 ce 0f 9a 7f e3 bd 26 97 25 54 bf 5d 7b 32 4c 1b e5 a2 3c a9 34 25 27 ed a2 eb a8 80 7a ac ee 81 cc 17 91 65 52 ec 9d e9 7d e8 48 a0 9d 3e 0c fe ad e8 65 e3 5a 82 df fc 45 36 08 a3 5d 2c f7 0a 26 61 e1 3e 03 a7 0e 63 87 c6 11 47 c6
                                                                                        Data Ascii: $^@?,X{%5yb~\djI.gpk'G&5**bDL7,5& nrskFh0wVuhqTw(B+[tn[Y-*Xi=U:&%T]{2L<4%'zeR}H>eZE6],&a>cG
                                                                                        2022-07-25 13:17:44 UTC3282INData Raw: 65 b7 c4 cc d1 f5 82 a5 c6 c1 c8 32 73 d9 0f 48 c9 80 3a c9 ec cf dd 7e d1 89 7d a3 23 6f 98 6a bf f2 62 26 e0 ce 59 f8 07 7b 30 17 dc 26 b9 6b 8d 3e a8 c2 76 72 cb 3b aa 2b 13 cb 32 fd 96 7e fc e2 5b 06 50 d1 78 c3 5a 6e de b6 48 5f 8d 2f 32 08 fe 5e 81 da bf 74 dc 00 00 ab d1 9d 5c e9 9b c9 37 b1 8d 9b f5 a9 73 a2 79 37 1d 25 43 73 70 b3 ec 2e e4 b3 3c a1 85 76 ba 1f 9c f0 6a d9 f1 59 82 e0 7e 5b f2 ab 05 28 c0 19 bc cf 84 19 be 34 1c a9 67 b8 00 74 af 73 f3 9e f6 53 03 33 71 a3 91 d1 c6 4d d3 35 3b 4f 10 46 b1 e7 c3 62 99 6e de 15 25 1f 0a b3 a8 0a 4b 9c 74 0f 6a 88 92 92 db 8f 2e d3 5b 90 eb 33 06 a1 58 73 9d 8d b9 79 45 6b c1 ad 58 55 ab 58 eb a2 95 9e f3 2a 3d 05 2e 69 a6 7b 46 29 4d c1 0e 2e 2b 7f e1 49 f5 fb f7 02 fc 10 f7 00 a7 e7 89 eb 35 ee aa
                                                                                        Data Ascii: e2sH:~}#ojb&Y{0&k>vr;+2~[PxZnH_/2^t\7sy7%Csp.<vjY~[(4gtsS3qM5;OFbn%Ktj.[3XsyEkXUX*=.i{F)M.+I5
                                                                                        2022-07-25 13:17:44 UTC3298INData Raw: c9 3b b0 6c b0 91 50 70 b3 26 28 87 7d 48 7a 33 a4 da e6 df 49 e4 00 d6 bf 6d a3 34 4a 77 90 c9 53 25 03 1f 66 0f b2 e9 4b f0 61 b1 fd 65 0c 8a a9 fc de bb 5c 65 35 5c cc 5b b2 3b f0 de 2b 3d 7e fd b9 f1 83 de a8 ad ef e9 49 20 b3 e3 1c f8 64 d5 2b 6c d8 08 83 82 86 65 2d ca 58 cc d1 f1 12 d9 ec d3 5d 36 47 bb f9 99 fe a1 9c cf f2 97 cb 9e ab 61 41 b3 60 82 1d 99 f6 df e6 16 26 c7 6a 50 50 ce bb 6f 55 8d 04 7a 0e 0d 33 74 39 78 33 bd 7b 3d f0 bb 2b 8d 25 72 47 2f c2 59 0c 0b 7a 6e 87 b2 7e cc 78 6c c3 19 1d ba 62 72 fd e8 a2 f6 b6 2d 5d 21 d8 fd 7e 05 17 40 f3 66 f9 58 3c c0 30 c8 7d 49 13 07 f1 a5 04 10 a0 77 9a 84 0e e4 c7 e1 9b 92 27 ac 1a 2f d9 48 d2 55 54 6c 0d c6 70 0b 2d 25 4a 21 b4 3f fd fd 36 f8 a3 2c 27 ce d6 7f e5 9c 05 83 6c 81 98 bd 7e 3e 6f
                                                                                        Data Ascii: ;lPp&(}Hz3Im4JwS%fKae\e5\[;+=~I d+le-X]6GaA`&jPPoUz3t9x3{=+%rG/Yzn~xlbr-]!~@fX<0}Iw'/HUTlp-%J!?6,'l~>o
                                                                                        2022-07-25 13:17:44 UTC3314INData Raw: 7e cd 37 9c 95 4d 53 6b c9 25 b2 74 75 1d c4 69 03 5e 2b 54 d1 89 49 73 d5 54 be ca d7 af 54 14 3d 03 66 26 ff bf ac 24 29 84 ad 49 de 62 a1 52 c6 62 5d 71 04 e3 ec 4a 9a 79 c5 f4 8e 9c e6 4f 13 dd d9 4f 26 e6 48 e1 a3 df fd f1 0b f2 6d 81 ba a9 43 34 c1 86 01 ac 3a 4c 70 cf 1e 8f f0 36 d9 50 30 54 e8 4d 43 bf ce 77 80 67 cd df 3a c9 70 44 ac 0e db a1 82 77 7f f9 cc 72 1b b7 6f f3 4b de 19 6b 7a be 4a 7a 5b 86 8d ec 39 bf 8a b8 ca 5e 9b 17 4b 7e 87 8f 3e f0 86 59 c6 a4 38 ff 84 e9 da 08 6a 3e 27 88 a1 18 f4 e1 3f a0 62 c9 00 2d 44 58 b3 2f ce 4e f5 ee ea f6 3d 7f 72 7b c6 eb f7 be 48 5c a7 da a6 6a 96 2e 40 b1 27 5d 10 84 cb 35 b5 9f 14 4c 85 a9 72 3f cb 14 ea 7a 99 cf 0e 8c 51 c5 40 69 73 3d 32 bd 90 fe 9f 42 d9 b7 42 8a 56 c0 f4 42 a9 16 3a a8 39 e1 77
                                                                                        Data Ascii: ~7MSk%tui^+TIsTT=f&$)IbRb]qJyOO&HmC4:Lp6P0TMCwg:pDwroKkzJz[9^K~>Y8j>'?b-DX/N=r{H\j.@']5Lr?zQ@is=2BBVB:9w
                                                                                        2022-07-25 13:17:44 UTC3330INData Raw: 44 e1 1d 5c fa d8 4c 4a 57 16 3a 41 a8 55 cd c4 7d 16 69 24 3a e2 92 e8 58 55 4d e2 a5 f1 cb e1 7f 5b 59 9e 43 86 7f 1e 68 ba ce 63 5d 64 88 b2 b5 b4 09 99 1c 61 10 71 78 58 b8 e0 ec 0d a1 73 4e a4 f2 6d ca e9 d4 1b d8 dd ec 33 87 60 3d cf 16 c7 f5 99 ba 5c 03 d5 16 4f 45 94 bc e4 e6 4d 3a e3 d2 14 f0 e7 97 6f 6a f7 3c d0 21 bd d4 ca f4 0f 87 4a 0d 8c ef c7 09 86 8f d7 28 7a d0 51 8b 55 3d 5b c8 13 98 74 ae 0e 9f fd 0e f2 2d 06 aa 5a d1 ff 8e e1 9e 1b d5 6c 79 a1 26 cb c0 d8 68 8e d2 ee f0 31 89 91 74 1c c7 3e a1 33 0b a2 88 88 81 e7 19 d5 ee 99 14 dd 1e b6 15 12 0b e7 df 9f f3 d5 9d e3 4f df 4e d7 66 66 b3 4d 82 52 10 dd 03 ad cb 16 71 b7 24 ee b2 8f 1d 14 1b 4a e7 e6 8c e7 6e b9 f7 3f de b7 98 a8 e9 a1 9a f1 73 78 58 6a 6d 78 f8 7d 66 74 37 ab d9 86 ee
                                                                                        Data Ascii: D\LJW:AU}i$:XUM[YChc]daqxXsNm3`=\OEM:oj<!J(zQU=[t-Zly&h1t>3ONffMRq$Jn?sxXjmx}ft7


                                                                                        Statistics

                                                                                        CPU Usage

                                                                                        Click to jump to process

                                                                                        Memory Usage

                                                                                        Click to jump to process

                                                                                        High Level Behavior Distribution

                                                                                        Click to dive into process behavior distribution

                                                                                        Behavior

                                                                                        Click to jump to process

                                                                                        System Behavior

                                                                                        General

                                                                                        Target ID:0
                                                                                        Start time:15:17:39
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe" > cmdline.out 2>&1
                                                                                        Imagebase:0x1190000
                                                                                        File size:232960 bytes
                                                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:1
                                                                                        Start time:15:17:40
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff647620000
                                                                                        File size:625664 bytes
                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:2
                                                                                        Start time:15:17:40
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\SysWOW64\wget.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/MindShow/USBDisplay/raw/main/WinDows/MSDisplay_Windows_V2.0.1.7.3.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:3895184 bytes
                                                                                        MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:6
                                                                                        Start time:15:17:49
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:3411586 bytes
                                                                                        MD5 hash:44B238973B55B2D863BC8608140AF84D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:Borland Delphi
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:7
                                                                                        Start time:15:17:51
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-0EGFU.tmp\MSDisplay_Windows_V2.0.1.7.3.tmp" /SL5="$140394,2565338,868864,C:\Users\user\Desktop\download\MSDisplay_Windows_V2.0.1.7.3.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:3200512 bytes
                                                                                        MD5 hash:3656DEEFA846EB33067D66B624232474
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:Borland Delphi
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:8
                                                                                        Start time:15:18:00
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:10
                                                                                        Start time:15:18:10
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:11
                                                                                        Start time:15:18:10
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:12
                                                                                        Start time:15:18:10
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:13
                                                                                        Start time:15:18:11
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:14
                                                                                        Start time:15:18:12
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:15
                                                                                        Start time:15:18:13
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\SgrmBroker.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                        Imagebase:0x7ff7edc20000
                                                                                        File size:163336 bytes
                                                                                        MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:16
                                                                                        Start time:15:18:14
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:17
                                                                                        Start time:15:18:14
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:18
                                                                                        Start time:15:18:17
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:19
                                                                                        Start time:15:18:18
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:20
                                                                                        Start time:15:18:24
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:21
                                                                                        Start time:15:18:28
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Program Files\USM USB Display\tool\x64\devcon.exe" dp_add "C:\Program Files\USM USB Display\lib_usb\MSUSBDisplay.inf" USB\VID_534D&PID_6021&MI_03
                                                                                        Imagebase:0x7ff625f00000
                                                                                        File size:103328 bytes
                                                                                        MD5 hash:8C7D36AD908F5F1A5E39F95AC92581F5
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:22
                                                                                        Start time:15:18:28
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff647620000
                                                                                        File size:625664 bytes
                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:23
                                                                                        Start time:15:18:37
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Program Files\USM USB Display\WinUsbDisplay.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Program Files\USM USB Display\WinUsbDisplay.exe"
                                                                                        Imagebase:0x1100000
                                                                                        File size:1493504 bytes
                                                                                        MD5 hash:F70F3B35A5543365775F3EBD2C541F3E
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:24
                                                                                        Start time:15:18:38
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s DeviceInstall
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:25
                                                                                        Start time:15:18:39
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\drvinst.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{b3252519-cc7b-324a-a914-41ec09755660}\MSUSBDisplay.inf" "9" "42202a2d7" "00000000000001A8" "WinSta0\Default" "00000000000001AC" "208" "C:\Program Files\USM USB Display\lib_usb"
                                                                                        Imagebase:0x7ff68d130000
                                                                                        File size:166912 bytes
                                                                                        MD5 hash:46F5A16FA391AB6EA97C602B4D2E7819
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:26
                                                                                        Start time:15:18:41
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:27
                                                                                        Start time:15:18:45
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Program Files\USM USB Display\WinUsbDisplay.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Program Files\USM USB Display\WinUsbDisplay.exe"
                                                                                        Imagebase:0x1100000
                                                                                        File size:1493504 bytes
                                                                                        MD5 hash:F70F3B35A5543365775F3EBD2C541F3E
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:29
                                                                                        Start time:15:19:08
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:31
                                                                                        Start time:15:19:16
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Program Files\USM USB Display\tool\x64\devcon.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Program Files\USM USB Display\tool\x64\devcon.exe" install "C:\Program Files\USM USB Display\idd\indirectdisplaybus\indirectdisplaybus.inf" root\IndirectDisplayBus
                                                                                        Imagebase:0x7ff625f00000
                                                                                        File size:103328 bytes
                                                                                        MD5 hash:8C7D36AD908F5F1A5E39F95AC92581F5
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:33
                                                                                        Start time:15:19:16
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff647620000
                                                                                        File size:625664 bytes
                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:34
                                                                                        Start time:15:19:18
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                        Imagebase:0x7ff678970000
                                                                                        File size:455656 bytes
                                                                                        MD5 hash:A267555174BFA53844371226F482B86B
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:35
                                                                                        Start time:15:19:18
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff647620000
                                                                                        File size:625664 bytes
                                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:38
                                                                                        Start time:15:19:46
                                                                                        Start date:25/07/2022
                                                                                        Path:C:\Windows\System32\drvinst.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{36d50466-c6bd-1345-8216-87f60ecb0250}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001BC" "WinSta0\Default" "00000000000001B8" "208" "c:\program files\usm usb display\idd\indirectdisplaybus"
                                                                                        Imagebase:0x7ff68d130000
                                                                                        File size:166912 bytes
                                                                                        MD5 hash:46F5A16FA391AB6EA97C602B4D2E7819
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low

                                                                                        Disassembly

                                                                                        Reset < >

                                                                                          Non-executed Functions

                                                                                          Function 00CB7EA4 Relevance: .1, Instructions: 114COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, Offset: 00CA8000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_2_2_ca8000_wget.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ef9185bfee5f8e8429e0c789ba3fd04ffeb954a114cb8098eb3d631223ebe461
                                                                                          • Instruction ID: 1b13c2097fd526bc13af3a66fb1c9cd7c76c3e6320e746d0fc1237eca6b57b72
                                                                                          • Opcode Fuzzy Hash: ef9185bfee5f8e8429e0c789ba3fd04ffeb954a114cb8098eb3d631223ebe461
                                                                                          • Instruction Fuzzy Hash: AD41487144E7D28FC3038B748861A827FB5AF4722471E45EBE4C0CF0A3E229595BC762
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00CAC969 Relevance: .1, Instructions: 89COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000002.00000002.235981150.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp, Offset: 00CA8000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_2_2_ca8000_wget.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c02e2f525f82d16c2a57e9abd1d54b053260231f22e6160034d1237795dd0fec
                                                                                          • Instruction ID: 6e6651efeed496dc3f335c6d1b730b671966aa8c00df6288a32b5b2e39fc300c
                                                                                          • Opcode Fuzzy Hash: c02e2f525f82d16c2a57e9abd1d54b053260231f22e6160034d1237795dd0fec
                                                                                          • Instruction Fuzzy Hash: C931BB6240E7C58FC3238B3088A5151BF71AF17208B2E89CFC4C1CF4B3E26A594AD722
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Execution Graph

                                                                                          Execution Coverage:3.4%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:13.1%
                                                                                          Total number of Nodes:765
                                                                                          Total number of Limit Nodes:26
                                                                                          execution_graph 29919 409ff0 29920 40a01d 29919->29920 29921 409ffe 29919->29921 29921->29920 29924 409fa8 29921->29924 29925 409fd4 29924->29925 29926 409fb8 GetModuleFileNameW 29924->29926 29928 40b234 GetModuleFileNameW 29926->29928 29929 40b282 29928->29929 29938 40b110 29929->29938 29931 40b2ae 29932 40b2c8 29931->29932 29933 40b2c0 LoadLibraryExW 29931->29933 29964 407a80 29932->29964 29933->29932 29939 40b131 29938->29939 29940 407a20 11 API calls 29939->29940 29941 40b14e 29940->29941 29955 40b1b9 29941->29955 29972 407e48 29941->29972 29943 407a80 11 API calls 29945 40b226 29943->29945 29945->29931 29946 40b194 29976 40ae34 29946->29976 29950 40b1bb GetUserDefaultUILanguage 29984 40a7e4 EnterCriticalSection 29950->29984 29951 40b1ac 29953 40af60 13 API calls 29951->29953 29953->29955 29955->29943 29958 40b1fd 29958->29955 30023 40b044 29958->30023 29959 40b1e3 GetSystemDefaultUILanguage 29960 40a7e4 28 API calls 29959->29960 29962 40b1f0 29960->29962 29963 40af60 13 API calls 29962->29963 29963->29958 29966 407a86 29964->29966 29965 407aac 29968 407a20 29965->29968 29966->29965 30131 40540c 11 API calls 29966->30131 29969 407a26 29968->29969 29971 407a41 29968->29971 29969->29971 30132 40540c 11 API calls 29969->30132 29971->29925 29974 407e4c 29972->29974 29973 407e70 29973->29946 30041 4088ac 29973->30041 29974->29973 30045 40540c 11 API calls 29974->30045 29977 40ae56 29976->29977 29980 40ae68 29976->29980 30046 40ab18 29977->30046 29979 40ae60 30070 40ae98 18 API calls 29979->30070 29982 407a20 11 API calls 29980->29982 29983 40ae8a 29982->29983 29983->29950 29983->29951 29985 40a830 LeaveCriticalSection 29984->29985 29986 40a810 29984->29986 29987 407a20 11 API calls 29985->29987 29988 40a821 LeaveCriticalSection 29986->29988 29989 40a841 IsValidLocale 29987->29989 29990 40a8d2 29988->29990 29991 40a850 29989->29991 29992 40a89f EnterCriticalSection 29989->29992 29998 407a20 11 API calls 29990->29998 29994 40a864 29991->29994 29995 40a859 29991->29995 29993 40a8b7 29992->29993 30002 40a8c8 LeaveCriticalSection 29993->30002 30074 40a4cc 14 API calls 29994->30074 30073 40a6c8 17 API calls 29995->30073 30001 40a8e7 29998->30001 29999 40a862 29999->29992 30000 40a86d GetSystemDefaultUILanguage 30000->29992 30003 40a877 30000->30003 30009 40af60 30001->30009 30002->29990 30004 40a888 GetSystemDefaultUILanguage 30003->30004 30075 4086e4 30003->30075 30087 40a4cc 14 API calls 30004->30087 30007 40a895 30008 4086e4 11 API calls 30007->30008 30008->29992 30010 40af7f 30009->30010 30011 407a20 11 API calls 30010->30011 30012 40af9d 30011->30012 30013 40b00b 30012->30013 30015 40b013 30012->30015 30017 4088ac 11 API calls 30012->30017 30101 40873c 30012->30101 30112 40aef4 30012->30112 30014 407a20 11 API calls 30013->30014 30014->30015 30016 407a20 11 API calls 30015->30016 30018 40b028 30016->30018 30017->30012 30019 407a80 11 API calls 30018->30019 30021 40b035 30019->30021 30021->29958 30021->29959 30125 407b04 30023->30125 30026 40b094 30027 40873c 11 API calls 30026->30027 30028 40b0a1 30027->30028 30029 40aef4 13 API calls 30028->30029 30031 40b0a8 30029->30031 30030 40b0e1 30032 407a80 11 API calls 30030->30032 30031->30030 30034 40873c 11 API calls 30031->30034 30033 40b0fb 30032->30033 30035 407a20 11 API calls 30033->30035 30036 40b0cf 30034->30036 30037 40b103 30035->30037 30038 40aef4 13 API calls 30036->30038 30037->29955 30039 40b0d6 30038->30039 30039->30030 30040 407a20 11 API calls 30039->30040 30040->30030 30042 4088b7 30041->30042 30127 407ba8 30042->30127 30045->29973 30047 40ab2f 30046->30047 30048 40ab43 GetModuleFileNameW 30047->30048 30049 40ab58 30047->30049 30048->30049 30050 40ab80 RegOpenKeyExW 30049->30050 30051 40ad27 30049->30051 30052 40ac41 30050->30052 30053 40aba7 RegOpenKeyExW 30050->30053 30056 407a20 11 API calls 30051->30056 30071 40a928 7 API calls 30052->30071 30053->30052 30054 40abc5 RegOpenKeyExW 30053->30054 30054->30052 30057 40abe3 RegOpenKeyExW 30054->30057 30059 40ad3c 30056->30059 30057->30052 30060 40ac01 RegOpenKeyExW 30057->30060 30058 40ac5f RegQueryValueExW 30061 40acb0 RegQueryValueExW 30058->30061 30062 40ac7d 30058->30062 30059->29979 30060->30052 30063 40ac1f RegOpenKeyExW 30060->30063 30064 40acae 30061->30064 30065 40accc 30061->30065 30066 40ac85 RegQueryValueExW 30062->30066 30063->30051 30063->30052 30067 40ad16 RegCloseKey 30064->30067 30072 40540c 11 API calls 30064->30072 30068 40acd4 RegQueryValueExW 30065->30068 30066->30064 30067->29979 30068->30064 30070->29980 30071->30058 30072->30067 30073->29999 30074->30000 30076 408733 30075->30076 30077 4086e8 30075->30077 30076->30004 30078 4086f2 30077->30078 30084 407e00 30077->30084 30078->30076 30079 408728 30078->30079 30080 40870d 30078->30080 30083 408664 11 API calls 30079->30083 30089 408664 30080->30089 30081 407e44 30081->30004 30086 408712 30083->30086 30084->30081 30088 40540c 11 API calls 30084->30088 30086->30004 30087->30007 30088->30081 30090 4086af 30089->30090 30092 408671 30089->30092 30091 407a44 11 API calls 30090->30091 30095 4086ac 30091->30095 30092->30090 30093 408689 30092->30093 30093->30095 30096 407a44 30093->30096 30095->30086 30097 407a65 30096->30097 30098 407a4a 30096->30098 30097->30095 30098->30097 30100 40540c 11 API calls 30098->30100 30100->30097 30102 408740 30101->30102 30103 4087ae 30101->30103 30104 408748 30102->30104 30107 407e00 30102->30107 30104->30103 30109 408757 30104->30109 30120 407e00 30104->30120 30105 407e44 30105->30012 30107->30105 30119 40540c 11 API calls 30107->30119 30109->30103 30110 407e00 11 API calls 30109->30110 30111 4087aa 30110->30111 30111->30012 30113 40af09 30112->30113 30114 40af26 FindFirstFileW 30113->30114 30115 40af36 FindClose 30114->30115 30116 40af3c 30114->30116 30115->30116 30117 407a20 11 API calls 30116->30117 30118 40af51 30117->30118 30118->30012 30119->30105 30123 407e04 30120->30123 30121 407e44 30121->30109 30123->30121 30124 40540c 11 API calls 30123->30124 30124->30121 30126 407b08 GetUserDefaultUILanguage GetLocaleInfoW 30125->30126 30126->30026 30128 407bb8 30127->30128 30129 407a44 11 API calls 30128->30129 30130 407bd2 30129->30130 30130->29946 30131->29966 30132->29971 30133 4b60e8 30134 4b610d 30133->30134 30180 4af678 30134->30180 30137 4b611b 30250 4afa44 12 API calls 30137->30250 30138 4b6192 30185 4056d0 QueryPerformanceCounter 30138->30185 30141 4b6137 30141->30138 30251 426f08 11 API calls 30141->30251 30142 4b6197 30188 4aefe8 30142->30188 30145 4b612b 30148 4b64ec 30145->30148 30149 4b64d3 30145->30149 30147 4b616e 30157 4b6176 MessageBoxW 30147->30157 30153 4b6505 30148->30153 30158 4b64ff RemoveDirectoryW 30148->30158 30254 4af1b4 9 API calls 30149->30254 30150 407e00 11 API calls 30151 4b61ac 30150->30151 30207 422954 30151->30207 30155 4b6519 30153->30155 30156 4b650e DestroyWindow 30153->30156 30169 4b6542 30155->30169 30255 408d08 27 API calls 30155->30255 30156->30155 30157->30138 30160 4b6183 30157->30160 30158->30153 30252 41f238 75 API calls 30160->30252 30165 4b6538 30256 40540c 11 API calls 30165->30256 30168 4b61da 30170 40873c 11 API calls 30168->30170 30171 4b61e8 30170->30171 30172 407e00 11 API calls 30171->30172 30173 4b61f8 30172->30173 30230 423d00 30173->30230 30175 4b6237 30236 424748 30175->30236 30177 4b6299 30253 424a24 107 API calls 30177->30253 30179 4b62c0 30257 4af244 30180->30257 30186 4056dd GetTickCount 30185->30186 30187 4056eb 30185->30187 30186->30187 30187->30142 30195 4aeff0 30188->30195 30191 4af02f CreateDirectoryW 30192 4af039 GetLastError 30191->30192 30193 4af0af 30191->30193 30192->30195 30194 407e00 11 API calls 30193->30194 30196 4af0b9 30194->30196 30195->30191 30276 422d70 30195->30276 30301 4aeec8 30195->30301 30321 426f08 11 API calls 30195->30321 30322 419e18 11 API calls 30195->30322 30323 4232ec FormatMessageW 30195->30323 30327 426ed8 11 API calls 30195->30327 30328 41f264 11 API calls 30195->30328 30329 40711c 11 API calls 30195->30329 30198 407a80 11 API calls 30196->30198 30199 4af0d3 30198->30199 30201 407a80 11 API calls 30199->30201 30203 4af0e0 30201->30203 30203->30150 30208 422964 30207->30208 30209 4088ac 11 API calls 30208->30209 30210 422976 30209->30210 30211 4226c8 30210->30211 30212 4226f2 30211->30212 30213 422706 30212->30213 30214 4226f8 30212->30214 30216 4088ac 11 API calls 30213->30216 30215 40873c 11 API calls 30214->30215 30217 422704 30215->30217 30218 422719 30216->30218 30220 407a20 11 API calls 30217->30220 30219 40873c 11 API calls 30218->30219 30219->30217 30221 42273b 30220->30221 30222 422660 30221->30222 30223 42268e 30222->30223 30226 42266a 30222->30226 30224 407e00 11 API calls 30223->30224 30225 422697 30224->30225 30225->30168 30226->30223 30227 42267d 30226->30227 30228 40873c 11 API calls 30227->30228 30229 42268b 30228->30229 30229->30168 30231 423d0a 30230->30231 30403 423da8 30231->30403 30232 423d39 30234 423d4f 30232->30234 30406 423cac 108 API calls 30232->30406 30234->30175 30237 424755 30236->30237 30241 4247ae 30237->30241 30409 41f264 11 API calls 30237->30409 30239 4247a9 30410 40711c 11 API calls 30239->30410 30245 4247d6 30241->30245 30411 41f264 11 API calls 30241->30411 30243 4247d1 30412 40711c 11 API calls 30243->30412 30249 424819 30245->30249 30413 41f264 11 API calls 30245->30413 30247 424814 30414 40711c 11 API calls 30247->30414 30249->30177 30250->30145 30251->30147 30253->30179 30254->30148 30255->30165 30256->30169 30264 4af263 30257->30264 30258 4af299 30260 4af29b 30258->30260 30261 4af2a6 GetUserDefaultLangID 30258->30261 30259 4af29d 30273 42301c 57 API calls 30259->30273 30265 4af277 30260->30265 30266 4af218 GetLocaleInfoW 30260->30266 30261->30260 30263 4af2a2 30263->30260 30264->30258 30264->30259 30264->30265 30267 4af60c 30265->30267 30266->30260 30268 4af614 30267->30268 30269 4af64f 30267->30269 30268->30269 30274 407f5c 11 API calls 30268->30274 30269->30137 30269->30141 30271 4af635 30275 427000 11 API calls 30271->30275 30273->30263 30274->30271 30275->30269 30330 422a90 30276->30330 30279 422da0 30281 422a90 12 API calls 30279->30281 30283 422ded 30279->30283 30282 422db0 30281->30282 30284 422dbc 30282->30284 30287 422a6c 12 API calls 30282->30287 30338 4228a4 30283->30338 30284->30283 30350 41ff2c 49 API calls 30284->30350 30287->30284 30288 422dc5 30291 422a90 12 API calls 30288->30291 30300 422de2 30288->30300 30290 422660 11 API calls 30293 422e02 30290->30293 30295 422dd6 30291->30295 30294 407e00 11 API calls 30293->30294 30296 422e0c 30294->30296 30298 422a6c 12 API calls 30295->30298 30295->30300 30297 407a80 11 API calls 30296->30297 30299 422e26 30297->30299 30298->30300 30299->30195 30300->30283 30351 422d18 GetWindowsDirectoryW 30300->30351 30302 4aeeec 30301->30302 30303 422660 11 API calls 30302->30303 30304 4aef05 30303->30304 30305 407e48 11 API calls 30304->30305 30306 4aef10 30305->30306 30307 4229ac 11 API calls 30306->30307 30313 4aef8e 30306->30313 30366 4aee50 30306->30366 30374 4087c4 30306->30374 30380 4271cc 30306->30380 30388 426f08 11 API calls 30306->30388 30389 41f264 11 API calls 30306->30389 30390 40711c 11 API calls 30306->30390 30307->30306 30315 407e00 11 API calls 30313->30315 30316 4aef99 30315->30316 30317 407a80 11 API calls 30316->30317 30318 4aefb3 30317->30318 30319 407a80 11 API calls 30318->30319 30320 4aefc0 30319->30320 30320->30195 30321->30195 30322->30195 30324 423312 30323->30324 30325 407ba8 11 API calls 30324->30325 30326 423332 30325->30326 30326->30195 30327->30195 30328->30195 30331 408664 11 API calls 30330->30331 30337 422aa3 30331->30337 30332 422abe GetEnvironmentVariableW 30333 422aca 30332->30333 30332->30337 30334 407a20 11 API calls 30333->30334 30336 422ad1 30334->30336 30336->30279 30347 422a6c 30336->30347 30337->30332 30337->30336 30352 422e84 11 API calls 30337->30352 30339 4228ad 30338->30339 30339->30339 30340 4228d4 GetFullPathNameW 30339->30340 30341 4228e0 30340->30341 30342 4228f7 30340->30342 30341->30342 30343 4228e8 30341->30343 30344 407e00 11 API calls 30342->30344 30345 407ba8 11 API calls 30343->30345 30346 4228f5 30344->30346 30345->30346 30346->30290 30353 422a18 30347->30353 30350->30288 30351->30283 30352->30337 30359 4229ac 30353->30359 30355 422a38 30356 422a40 GetFileAttributesW 30355->30356 30357 407a20 11 API calls 30356->30357 30358 422a5d 30357->30358 30358->30279 30360 4229bd 30359->30360 30361 422a03 30360->30361 30362 4229f8 30360->30362 30364 4088ac 11 API calls 30361->30364 30363 407e00 11 API calls 30362->30363 30365 422a01 30363->30365 30364->30365 30365->30355 30367 407a20 11 API calls 30366->30367 30369 4aee71 30367->30369 30371 4aeea2 30369->30371 30391 408510 30369->30391 30394 408950 30369->30394 30372 407a20 11 API calls 30371->30372 30373 4aeeb7 30372->30373 30373->30306 30375 4087da 30374->30375 30376 408664 11 API calls 30375->30376 30377 408815 30375->30377 30378 40885f 30375->30378 30376->30377 30377->30378 30379 407e00 11 API calls 30377->30379 30379->30378 30398 427108 Wow64DisableWow64FsRedirection SetLastError 30380->30398 30382 4271e2 30383 4271e6 30382->30383 30399 422a80 30382->30399 30383->30306 30387 427221 30387->30306 30388->30306 30389->30306 30392 407ba8 11 API calls 30391->30392 30393 40851d 30392->30393 30393->30369 30395 408965 30394->30395 30396 408664 11 API calls 30395->30396 30397 4089ba 30395->30397 30396->30397 30397->30369 30398->30382 30400 422a18 12 API calls 30399->30400 30401 422a8a GetLastError 30400->30401 30402 427144 Wow64RevertWow64FsRedirection 30401->30402 30402->30387 30407 4084ec 30403->30407 30406->30234 30408 4084f2 CreateFileW 30407->30408 30408->30232 30409->30239 30411->30243 30413->30247 30415 4b62df 30416 4b6304 30415->30416 30418 4b633c 30416->30418 30427 4af834 11 API calls 30416->30427 30423 423ed8 SetEndOfFile 30418->30423 30420 4b6358 30428 40540c 11 API calls 30420->30428 30422 4b638f 30424 423ee8 30423->30424 30425 423eef 30423->30425 30429 423cac 108 API calls 30424->30429 30425->30420 30427->30418 30428->30422 30429->30425 30430 41ff94 30431 407e48 11 API calls 30430->30431 30432 41ffc4 30431->30432 30445 407fb0 30432->30445 30434 41ffcc 30435 41ffd8 GetFileVersionInfoSizeW 30434->30435 30436 42007e 30435->30436 30439 41ffe8 30435->30439 30437 407a20 11 API calls 30436->30437 30438 420093 30437->30438 30440 420011 GetFileVersionInfoW 30439->30440 30441 420035 30440->30441 30442 42001b VerQueryValueW 30440->30442 30449 40540c 11 API calls 30441->30449 30442->30441 30444 420076 30447 407f18 30445->30447 30446 407f53 30446->30434 30447->30446 30450 40540c 11 API calls 30447->30450 30449->30444 30450->30446 30451 4b5eec 30478 40d1cc GetModuleHandleW 30451->30478 30460 407e00 11 API calls 30461 4b5f5e 30460->30461 30462 423d00 109 API calls 30461->30462 30463 4b5f76 30462->30463 30510 4af9f0 FindResourceW 30463->30510 30466 4b5feb 30523 423cc0 30466->30523 30467 4b5f8e 30467->30466 30545 4af834 11 API calls 30467->30545 30469 4b6011 30470 4b602d 30469->30470 30546 4af834 11 API calls 30469->30546 30472 424748 11 API calls 30470->30472 30473 4b6053 30472->30473 30527 425cd8 30473->30527 30475 4b607e 30476 4b60c9 30475->30476 30477 425cd8 107 API calls 30475->30477 30477->30475 30479 40d207 30478->30479 30547 407484 30479->30547 30482 4af91c GetSystemInfo VirtualQuery 30483 4af9e7 30482->30483 30486 4af948 30482->30486 30488 4af474 30483->30488 30484 4af9c7 VirtualQuery 30484->30483 30484->30486 30485 4af978 VirtualProtect 30485->30486 30486->30483 30486->30484 30486->30485 30487 4af9b1 VirtualProtect 30486->30487 30487->30484 30723 422c14 GetCommandLineW 30488->30723 30490 4af55d 30491 407a80 11 API calls 30490->30491 30492 4af577 30491->30492 30496 422c74 30492->30496 30493 422c74 13 API calls 30495 4af492 30493->30495 30494 4088ac 11 API calls 30494->30495 30495->30490 30495->30493 30495->30494 30497 422c9b GetModuleFileNameW 30496->30497 30498 422cbf GetCommandLineW 30496->30498 30499 407ba8 11 API calls 30497->30499 30500 422cc6 30498->30500 30501 422cbd 30499->30501 30502 422ccc 30500->30502 30505 422b34 11 API calls 30500->30505 30506 422cd4 30500->30506 30503 422cf3 30501->30503 30504 407a20 11 API calls 30502->30504 30507 407a20 11 API calls 30503->30507 30504->30506 30505->30500 30509 407e00 11 API calls 30506->30509 30508 422d08 30507->30508 30508->30460 30509->30503 30511 4afa0a SizeofResource 30510->30511 30512 4afa05 30510->30512 30514 4afa1c LoadResource 30511->30514 30515 4afa17 30511->30515 30745 4af834 11 API calls 30512->30745 30517 4afa2a 30514->30517 30518 4afa2f LockResource 30514->30518 30746 4af834 11 API calls 30515->30746 30747 4af834 11 API calls 30517->30747 30520 4afa3b 30518->30520 30521 4afa40 30518->30521 30748 4af834 11 API calls 30520->30748 30521->30467 30524 423cd4 30523->30524 30525 423ce4 30524->30525 30749 423bf8 107 API calls 30524->30749 30525->30469 30531 425d09 30527->30531 30533 425d54 30527->30533 30528 425da1 30753 424a24 107 API calls 30528->30753 30529 424a24 107 API calls 30529->30531 30530 424a24 107 API calls 30530->30533 30531->30529 30531->30533 30536 408664 11 API calls 30531->30536 30542 407fa0 11 API calls 30531->30542 30544 407e00 11 API calls 30531->30544 30533->30528 30533->30530 30750 408254 11 API calls 30533->30750 30751 407f5c 11 API calls 30533->30751 30752 407e9c 11 API calls 30533->30752 30534 425db9 30537 407a44 11 API calls 30534->30537 30536->30531 30538 425dce 30537->30538 30539 407a20 11 API calls 30538->30539 30540 425dd6 30539->30540 30540->30475 30542->30531 30544->30531 30545->30466 30546->30470 30548 4074bc 30547->30548 30551 407418 30548->30551 30552 407460 30551->30552 30553 407428 30551->30553 30552->30482 30553->30552 30558 4232ec 12 API calls 30553->30558 30560 40caa4 GetSystemInfo 30553->30560 30561 4b5114 30553->30561 30633 4b5980 30553->30633 30645 4b5000 30553->30645 30657 4b5a90 30553->30657 30558->30553 30560->30553 30562 4b511c 30561->30562 30562->30562 30563 4b536d 30562->30563 30564 4b5141 GetModuleHandleW GetVersion 30562->30564 30565 407a80 11 API calls 30563->30565 30566 4b517a 30564->30566 30567 4b515c GetProcAddress 30564->30567 30571 4b5387 30565->30571 30569 4b5182 GetProcAddress 30566->30569 30570 4b5344 GetProcAddress 30566->30570 30567->30566 30568 4b516d 30567->30568 30568->30566 30572 4b5191 30569->30572 30573 4b535a GetProcAddress 30570->30573 30574 4b5353 30570->30574 30571->30553 30675 40e520 GetSystemDirectoryW 30572->30675 30573->30563 30576 4b5369 SetProcessDEPPolicy 30573->30576 30574->30573 30576->30563 30577 4b51a0 30578 407e00 11 API calls 30577->30578 30579 4b51ad 30578->30579 30579->30570 30580 4b51e5 30579->30580 30581 4086e4 11 API calls 30579->30581 30582 40873c 11 API calls 30580->30582 30581->30580 30583 4b51f8 30582->30583 30676 40e54c SetErrorMode LoadLibraryW 30583->30676 30585 4b5200 30586 40873c 11 API calls 30585->30586 30587 4b5213 30586->30587 30677 40e54c SetErrorMode LoadLibraryW 30587->30677 30589 4b521b 30590 40873c 11 API calls 30589->30590 30591 4b522e 30590->30591 30678 40e54c SetErrorMode LoadLibraryW 30591->30678 30593 4b5236 30594 40873c 11 API calls 30593->30594 30595 4b5249 30594->30595 30679 40e54c SetErrorMode LoadLibraryW 30595->30679 30597 4b5251 30598 40873c 11 API calls 30597->30598 30599 4b5264 30598->30599 30680 40e54c SetErrorMode LoadLibraryW 30599->30680 30601 4b526c 30602 40873c 11 API calls 30601->30602 30603 4b527f 30602->30603 30681 40e54c SetErrorMode LoadLibraryW 30603->30681 30605 4b5287 30606 40873c 11 API calls 30605->30606 30607 4b529a 30606->30607 30682 40e54c SetErrorMode LoadLibraryW 30607->30682 30609 4b52a2 30610 40873c 11 API calls 30609->30610 30611 4b52b5 30610->30611 30683 40e54c SetErrorMode LoadLibraryW 30611->30683 30613 4b52bd 30614 40873c 11 API calls 30613->30614 30615 4b52d0 30614->30615 30684 40e54c SetErrorMode LoadLibraryW 30615->30684 30617 4b52d8 30618 40873c 11 API calls 30617->30618 30619 4b52eb 30618->30619 30685 40e54c SetErrorMode LoadLibraryW 30619->30685 30621 4b52f3 30622 40873c 11 API calls 30621->30622 30623 4b5306 30622->30623 30686 40e54c SetErrorMode LoadLibraryW 30623->30686 30625 4b530e 30626 40873c 11 API calls 30625->30626 30627 4b5321 30626->30627 30687 40e54c SetErrorMode LoadLibraryW 30627->30687 30629 4b5329 30630 40873c 11 API calls 30629->30630 30631 4b533c 30630->30631 30688 40e54c SetErrorMode LoadLibraryW 30631->30688 30634 4b599e 30633->30634 30635 4b5a33 30633->30635 30689 407588 30634->30689 30635->30553 30637 4b59a8 30638 407e00 11 API calls 30637->30638 30639 4b59ca 30637->30639 30638->30639 30640 40ae34 48 API calls 30639->30640 30641 4b5a11 30640->30641 30695 420524 53 API calls 30641->30695 30643 4b5a2e 30696 4206d8 121 API calls 30643->30696 30646 4b50c9 30645->30646 30647 4b501e 30645->30647 30646->30553 30648 4b5028 SetThreadLocale 30647->30648 30700 40a250 InitializeCriticalSection GetVersion 30648->30700 30652 4b505e 30653 4b5077 GetCommandLineW 30652->30653 30704 403810 GetStartupInfoW 30653->30704 30655 4b50a1 GetACP GetCurrentThreadId 30705 40cab8 GetVersion 30655->30705 30658 4b5b3f 30657->30658 30659 4b5ab4 GetModuleHandleW 30657->30659 30660 407a80 11 API calls 30658->30660 30706 40e1a8 30659->30706 30662 4b5b59 30660->30662 30662->30553 30663 4b5ac9 GetModuleHandleW 30664 40e1a8 13 API calls 30663->30664 30665 4b5ae3 30664->30665 30718 422d44 GetSystemDirectoryW 30665->30718 30667 4b5b0d 30668 422660 11 API calls 30667->30668 30669 4b5b18 30668->30669 30670 4086e4 11 API calls 30669->30670 30671 4b5b25 30670->30671 30720 421230 SetErrorMode 30671->30720 30673 4b5b32 30674 4232ec 12 API calls 30673->30674 30674->30658 30675->30577 30676->30585 30677->30589 30678->30593 30679->30597 30680->30601 30681->30605 30682->30609 30683->30613 30684->30617 30685->30621 30686->30625 30687->30629 30688->30570 30692 407594 30689->30692 30694 4075cb 30692->30694 30697 4074cc 75 API calls 30692->30697 30698 407524 75 API calls 30692->30698 30699 407574 75 API calls 30692->30699 30694->30637 30695->30643 30696->30635 30697->30692 30698->30692 30699->30692 30701 40a280 6 API calls 30700->30701 30702 40a2ce 30700->30702 30701->30702 30703 40caa4 GetSystemInfo 30702->30703 30703->30652 30704->30655 30705->30646 30707 40e1d0 GetProcAddress 30706->30707 30708 40e1dc 30706->30708 30709 40e230 30707->30709 30710 407a44 11 API calls 30708->30710 30711 407a44 11 API calls 30709->30711 30713 40e1f2 30710->30713 30712 40e245 30711->30712 30712->30663 30714 40e209 GetProcAddress 30713->30714 30715 40e220 30714->30715 30716 407a44 11 API calls 30715->30716 30717 40e228 30716->30717 30717->30663 30719 422d65 30718->30719 30719->30667 30721 4084ec 30720->30721 30722 421268 LoadLibraryW 30721->30722 30722->30673 30730 422b34 30723->30730 30725 422c4f 30727 407a20 11 API calls 30725->30727 30726 422b34 11 API calls 30728 422c36 30726->30728 30729 422c64 30727->30729 30728->30725 30728->30726 30729->30495 30731 422b5f 30730->30731 30732 407ba8 11 API calls 30731->30732 30733 422b6c 30732->30733 30740 407fa0 30733->30740 30735 422b74 30736 407e00 11 API calls 30735->30736 30737 422b8c 30736->30737 30738 407a20 11 API calls 30737->30738 30739 422bb4 30738->30739 30739->30728 30741 407f18 30740->30741 30742 407f53 30741->30742 30744 40540c 11 API calls 30741->30744 30742->30735 30744->30742 30745->30511 30746->30514 30747->30518 30748->30521 30749->30525 30750->30533 30751->30533 30752->30533 30753->30534 30754 403ee8 30755 403f00 30754->30755 30756 404148 30754->30756 30765 403f12 30755->30765 30770 403f9d Sleep 30755->30770 30757 404260 30756->30757 30758 40410c 30756->30758 30759 403c94 VirtualAlloc 30757->30759 30760 404269 30757->30760 30766 404126 Sleep 30758->30766 30768 404166 30758->30768 30762 403ccf 30759->30762 30763 403cbf 30759->30763 30761 403f21 30778 403c48 30763->30778 30764 404000 30777 40400c 30764->30777 30783 403bcc 30764->30783 30765->30761 30765->30764 30771 403fe1 Sleep 30765->30771 30766->30768 30769 40413c Sleep 30766->30769 30772 404184 30768->30772 30773 403bcc VirtualAlloc 30768->30773 30769->30758 30770->30765 30774 403fb3 Sleep 30770->30774 30771->30764 30776 403ff7 Sleep 30771->30776 30773->30772 30774->30755 30776->30765 30779 403c90 30778->30779 30780 403c51 30778->30780 30779->30762 30780->30779 30781 403c5c Sleep 30780->30781 30781->30779 30782 403c76 Sleep 30781->30782 30782->30780 30787 403b60 30783->30787 30785 403bd5 VirtualAlloc 30786 403bec 30785->30786 30786->30777 30788 403b00 30787->30788 30788->30785 30789 4b63a1 30790 4b63d3 30789->30790 30814 40e450 30790->30814 30792 4b640c SetWindowLongW 30818 41a87c 30792->30818 30797 4087c4 11 API calls 30798 4b648e 30797->30798 30826 4af728 30798->30826 30801 4b64b3 30803 4b64ec 30801->30803 30804 4b64d3 30801->30804 30802 4af60c 11 API calls 30802->30801 30806 4b6505 30803->30806 30809 4b64ff RemoveDirectoryW 30803->30809 30841 4af1b4 9 API calls 30804->30841 30807 4b6519 30806->30807 30808 4b650e DestroyWindow 30806->30808 30810 4b6542 30807->30810 30842 408d08 27 API calls 30807->30842 30808->30807 30809->30806 30812 4b6538 30843 40540c 11 API calls 30812->30843 30844 405740 30814->30844 30816 40e463 CreateWindowExW 30817 40e49d 30816->30817 30817->30792 30845 41a8a4 30818->30845 30821 422bc4 GetCommandLineW 30822 422b34 11 API calls 30821->30822 30823 422be7 30822->30823 30824 407a20 11 API calls 30823->30824 30825 422c05 30824->30825 30825->30797 30827 4087c4 11 API calls 30826->30827 30828 4af763 30827->30828 30829 4af795 CreateProcessW 30828->30829 30830 4af7aa CloseHandle 30829->30830 30831 4af7a1 30829->30831 30833 4af7b3 30830->30833 30863 4af34c 13 API calls 30831->30863 30864 4af6fc TranslateMessage DispatchMessageW PeekMessageW 30833->30864 30835 4af7b8 MsgWaitForMultipleObjects 30835->30833 30836 4af7d1 30835->30836 30865 4af6fc TranslateMessage DispatchMessageW PeekMessageW 30836->30865 30838 4af7d6 GetExitCodeProcess CloseHandle 30839 407a20 11 API calls 30838->30839 30840 4af7fe 30839->30840 30840->30801 30840->30802 30841->30803 30842->30812 30843->30810 30844->30816 30848 41a8bc 30845->30848 30849 41a8c5 30848->30849 30851 41a925 30849->30851 30861 41a7f4 106 API calls 30849->30861 30852 41a998 30851->30852 30860 41a942 30851->30860 30853 407ba8 11 API calls 30852->30853 30857 41a89c 30853->30857 30854 41a98c 30855 408664 11 API calls 30854->30855 30855->30857 30856 407a20 11 API calls 30856->30860 30857->30821 30858 408664 11 API calls 30858->30860 30860->30854 30860->30856 30860->30858 30862 41a7f4 106 API calls 30860->30862 30861->30851 30862->30860 30863->30830 30864->30835 30865->30838 30866 40426c 30867 404281 30866->30867 30868 404364 30866->30868 30870 404287 30867->30870 30873 4042fe Sleep 30867->30873 30869 403cf8 30868->30869 30868->30870 30871 40445e 30869->30871 30874 403c48 2 API calls 30869->30874 30872 404290 30870->30872 30876 404342 Sleep 30870->30876 30880 404379 30870->30880 30873->30870 30875 404318 Sleep 30873->30875 30877 403d09 30874->30877 30875->30867 30878 404358 Sleep 30876->30878 30876->30880 30879 403d1f VirtualFree 30877->30879 30882 403d39 30877->30882 30878->30870 30885 403d30 30879->30885 30883 40439c 30880->30883 30884 4043f8 VirtualFree 30880->30884 30881 403d42 VirtualQuery VirtualFree 30881->30882 30881->30885 30882->30881 30882->30885

                                                                                          Executed Functions

                                                                                          Function 004B5114 Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 165libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 75%
                                                                                          			E004B5114(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				long _t39;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t46;
				signed int _t51;
				void* _t111;
				void* _t112;
				intOrPtr _t129;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				struct HINSTANCE__* _t148;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t153;

				_t152 = _t153;
				_t112 = 7;
				do {
					_push(0);
					_push(0);
					_t112 = _t112 - 1;
				} while (_t112 != 0);
				_push(_t152);
				_push(0x4b5388);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x4be664 =  *0x4be664 - 1;
				if( *0x4be664 >= 0) {
					L19:
					_pop(_t129);
					 *[fs:eax] = _t129;
					_push(0x4b538f);
					return E00407A80( &_v60, 0xe);
				} else {
					_t148 = GetModuleHandleW(L"kernel32.dll");
					_t39 = GetVersion();
					_t111 = 0;
					if(_t39 != 0x600) {
						_t150 = GetProcAddress(_t148, "SetDefaultDllDirectories");
						if(_t150 != 0) {
							 *_t150(0x800);
							asm("sbb ebx, ebx");
							_t111 = 1;
						}
					}
					if(_t111 == 0) {
						_t46 = GetProcAddress(_t148, "SetDllDirectoryW");
						if(_t46 != 0) {
							 *_t46(0x4b53e4);
						}
						E0040E520( &_v8);
						E00407E00(0x4be668, _v8);
						if( *0x4be668 != 0) {
							_t51 =  *0x4be668; // 0x0
							if(_t51 != 0) {
								_t51 =  *(_t51 - 4);
							}
							_t132 =  *0x4be668; // 0x0
							if( *((short*)(_t132 + _t51 * 2 - 2)) != 0x5c) {
								E004086E4(0x4be668, 0x4b53f4);
							}
							_t133 =  *0x4be668; // 0x0
							E0040873C( &_v12, L"uxtheme.dll", _t133);
							E0040E54C(_v12, _t111);
							_t134 =  *0x4be668; // 0x0
							E0040873C( &_v16, L"userenv.dll", _t134);
							E0040E54C(_v16, _t111);
							_t135 =  *0x4be668; // 0x0
							E0040873C( &_v20, L"setupapi.dll", _t135);
							E0040E54C(_v20, _t111);
							_t136 =  *0x4be668; // 0x0
							E0040873C( &_v24, L"apphelp.dll", _t136);
							E0040E54C(_v24, _t111);
							_t137 =  *0x4be668; // 0x0
							E0040873C( &_v28, L"propsys.dll", _t137);
							E0040E54C(_v28, _t111);
							_t138 =  *0x4be668; // 0x0
							E0040873C( &_v32, L"dwmapi.dll", _t138);
							E0040E54C(_v32, _t111);
							_t139 =  *0x4be668; // 0x0
							E0040873C( &_v36, L"cryptbase.dll", _t139);
							E0040E54C(_v36, _t111);
							_t140 =  *0x4be668; // 0x0
							E0040873C( &_v40, L"oleacc.dll", _t140);
							E0040E54C(_v40, _t111);
							_t141 =  *0x4be668; // 0x0
							E0040873C( &_v44, L"version.dll", _t141);
							E0040E54C(_v44, _t111);
							_t142 =  *0x4be668; // 0x0
							E0040873C( &_v48, L"profapi.dll", _t142);
							E0040E54C(_v48, _t111);
							_t143 =  *0x4be668; // 0x0
							E0040873C( &_v52, L"comres.dll", _t143);
							E0040E54C(_v52, _t111);
							_t144 =  *0x4be668; // 0x0
							E0040873C( &_v56, L"clbcatq.dll", _t144);
							E0040E54C(_v56, _t111);
							_t145 =  *0x4be668; // 0x0
							E0040873C( &_v60, L"ntmarta.dll", _t145);
							E0040E54C(_v60, _t111);
						}
					}
					_t42 = GetProcAddress(_t148, "SetSearchPathMode");
					if(_t42 != 0) {
						 *_t42(0x8001);
					}
					_t43 = GetProcAddress(_t148, "SetProcessDEPPolicy");
					if(_t43 != 0) {
						 *_t43(1); // executed
					}
					goto L19;
				}
			}











































                                                                                          0x004b5115
                                                                                          0x004b5117
                                                                                          0x004b511c
                                                                                          0x004b511c
                                                                                          0x004b511e
                                                                                          0x004b5120
                                                                                          0x004b5120
                                                                                          0x004b5128
                                                                                          0x004b5129
                                                                                          0x004b512e
                                                                                          0x004b5131
                                                                                          0x004b5134
                                                                                          0x004b513b
                                                                                          0x004b536d
                                                                                          0x004b536f
                                                                                          0x004b5372
                                                                                          0x004b5375
                                                                                          0x004b5387
                                                                                          0x004b5141
                                                                                          0x004b514b
                                                                                          0x004b514d
                                                                                          0x004b5154
                                                                                          0x004b515a
                                                                                          0x004b5167
                                                                                          0x004b516b
                                                                                          0x004b5172
                                                                                          0x004b5177
                                                                                          0x004b5179
                                                                                          0x004b5179
                                                                                          0x004b516b
                                                                                          0x004b517c
                                                                                          0x004b5188
                                                                                          0x004b518f
                                                                                          0x004b5196
                                                                                          0x004b5196
                                                                                          0x004b519b
                                                                                          0x004b51a8
                                                                                          0x004b51b4
                                                                                          0x004b51ba
                                                                                          0x004b51c1
                                                                                          0x004b51c6
                                                                                          0x004b51c6
                                                                                          0x004b51c8
                                                                                          0x004b51d4
                                                                                          0x004b51e0
                                                                                          0x004b51e0
                                                                                          0x004b51ed
                                                                                          0x004b51f3
                                                                                          0x004b51fb
                                                                                          0x004b5208
                                                                                          0x004b520e
                                                                                          0x004b5216
                                                                                          0x004b5223
                                                                                          0x004b5229
                                                                                          0x004b5231
                                                                                          0x004b523e
                                                                                          0x004b5244
                                                                                          0x004b524c
                                                                                          0x004b5259
                                                                                          0x004b525f
                                                                                          0x004b5267
                                                                                          0x004b5274
                                                                                          0x004b527a
                                                                                          0x004b5282
                                                                                          0x004b528f
                                                                                          0x004b5295
                                                                                          0x004b529d
                                                                                          0x004b52aa
                                                                                          0x004b52b0
                                                                                          0x004b52b8
                                                                                          0x004b52c5
                                                                                          0x004b52cb
                                                                                          0x004b52d3
                                                                                          0x004b52e0
                                                                                          0x004b52e6
                                                                                          0x004b52ee
                                                                                          0x004b52fb
                                                                                          0x004b5301
                                                                                          0x004b5309
                                                                                          0x004b5316
                                                                                          0x004b531c
                                                                                          0x004b5324
                                                                                          0x004b5331
                                                                                          0x004b5337
                                                                                          0x004b533f
                                                                                          0x004b533f
                                                                                          0x004b51b4
                                                                                          0x004b534a
                                                                                          0x004b5351
                                                                                          0x004b5358
                                                                                          0x004b5358
                                                                                          0x004b5360
                                                                                          0x004b5367
                                                                                          0x004b536b
                                                                                          0x004b536b
                                                                                          0x00000000
                                                                                          0x004b5367

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B5146
                                                                                          • GetVersion.KERNEL32(kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B514D
                                                                                          • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004B5162
                                                                                          • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004B5188
                                                                                            • Part of subcall function 0040E54C: SetErrorMode.KERNEL32(00008000), ref: 0040E55A
                                                                                            • Part of subcall function 0040E54C: LoadLibraryW.KERNEL32(00000000,00000000,0040E5AE,?,00000000,0040E5CC,?,00008000), ref: 0040E58F
                                                                                          • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004B534A
                                                                                          • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004B5360
                                                                                          • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B536B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$ErrorHandleLibraryLoadModeModulePolicyProcessVersion
                                                                                          • String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
                                                                                          • API String ID: 2248137261-1119018034
                                                                                          • Opcode ID: 68b2adb77f8f7151d30e1a894141e6e7486eaa9f98baa6450b00b79ea83e97ab
                                                                                          • Instruction ID: 14362f36823de93a6bafc63c1bb5288ecf7b8ac372eee3bc1917329a49ba756d
                                                                                          • Opcode Fuzzy Hash: 68b2adb77f8f7151d30e1a894141e6e7486eaa9f98baa6450b00b79ea83e97ab
                                                                                          • Instruction Fuzzy Hash: 57513C34601504ABE701EBA6DC82FDEB3A5AB94348BA4493BE40077395DF7C9D428B6D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF91C Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 382 4af91c-4af942 GetSystemInfo VirtualQuery 383 4af948 382->383 384 4af9e7-4af9ee 382->384 385 4af9db-4af9e1 383->385 385->384 386 4af94d-4af954 385->386 387 4af956-4af95a 386->387 388 4af9c7-4af9d9 VirtualQuery 386->388 387->388 389 4af95c-4af967 387->389 388->384 388->385 390 4af978-4af98d VirtualProtect 389->390 391 4af969-4af96c 389->391 392 4af98f 390->392 393 4af994-4af996 390->393 391->390 394 4af96e-4af971 391->394 392->393 395 4af9a5-4af9a8 393->395 394->390 396 4af973-4af976 394->396 397 4af9aa-4af9af 395->397 398 4af998-4af9a1 call 4af914 395->398 396->390 396->393 397->388 400 4af9b1-4af9c2 VirtualProtect 397->400 398->395 400->388
                                                                                          C-Code - Quality: 100%
                                                                                          			E004AF91C(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				char _v88;
				long _t22;
				int _t28;
				void* _t37;
				struct _MEMORY_BASIC_INFORMATION* _t40;
				long _t41;
				void** _t42;

				_t42 =  &(_v80.dwPageSize);
				 *_t42 = __eax;
				_t40 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t22 = VirtualQuery( *_t42, _t40, 0x1c);
				if(_t22 == 0) {
					L17:
					return _t22;
				} else {
					while(1) {
						_t22 = _t40->AllocationBase;
						if(_t22 !=  *_t42) {
							goto L17;
						}
						if(_t40->State != 0x1000 || (_t40->Protect & 0x00000001) != 0) {
							L15:
							_t22 = VirtualQuery(_t40->BaseAddress + _t40->RegionSize, _t40, 0x1c);
							if(_t22 == 0) {
								goto L17;
							}
							continue;
						} else {
							_v88 = 0;
							_t41 = _t40->Protect;
							if(_t41 == 1 || _t41 == 2 || _t41 == 0x10 || _t41 == 0x20) {
								_t28 = VirtualProtect(_t40->BaseAddress, _t40->RegionSize, 0x40,  &_v84); // executed
								if(_t28 != 0) {
									_v88 = 1;
								}
							}
							_t37 = 0;
							while(_t37 < _t40->RegionSize) {
								E004AF914(_t40->BaseAddress + _t37);
								_t37 = _t37 + _v80.dwPageSize;
							}
							if(_v88 != 0) {
								VirtualProtect( *_t40, _t40->RegionSize, _v84,  &_v84); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}













                                                                                          0x004af920
                                                                                          0x004af923
                                                                                          0x004af926
                                                                                          0x004af92f
                                                                                          0x004af93b
                                                                                          0x004af942
                                                                                          0x004af9ee
                                                                                          0x004af9ee
                                                                                          0x004af948
                                                                                          0x004af9db
                                                                                          0x004af9db
                                                                                          0x004af9e1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af954
                                                                                          0x004af9c7
                                                                                          0x004af9d2
                                                                                          0x004af9d9
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af95c
                                                                                          0x004af95c
                                                                                          0x004af961
                                                                                          0x004af967
                                                                                          0x004af986
                                                                                          0x004af98d
                                                                                          0x004af98f
                                                                                          0x004af98f
                                                                                          0x004af98d
                                                                                          0x004af994
                                                                                          0x004af9a5
                                                                                          0x004af99c
                                                                                          0x004af9a1
                                                                                          0x004af9a1
                                                                                          0x004af9af
                                                                                          0x004af9c2
                                                                                          0x004af9c2
                                                                                          0x00000000
                                                                                          0x004af9af
                                                                                          0x004af954
                                                                                          0x00000000
                                                                                          0x004af9db

                                                                                          APIs
                                                                                          • GetSystemInfo.KERNEL32(?), ref: 004AF92F
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 004AF93B
                                                                                          • VirtualProtect.KERNEL32(?,?,00000040,0000001C,?,?,0000001C), ref: 004AF986
                                                                                          • VirtualProtect.KERNEL32(?,?,?,0000001C,?,?,00000040,0000001C,?,?,0000001C), ref: 004AF9C2
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C,?), ref: 004AF9D2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$ProtectQuery$InfoSystem
                                                                                          • String ID:
                                                                                          • API String ID: 2441996862-0
                                                                                          • Opcode ID: 57281b4e736338f8d77ca256b537dd22dd4c981be38144bf210ac0f1d0b120f5
                                                                                          • Instruction ID: 3a96586125c0dafbea7f6284d897bb751f900199eded140d0d018ead0d29608e
                                                                                          • Opcode Fuzzy Hash: 57281b4e736338f8d77ca256b537dd22dd4c981be38144bf210ac0f1d0b120f5
                                                                                          • Instruction Fuzzy Hash: C5212CB1104344BAD730DA99C885F6BBBEC9B56354F04492EF59583681D339E848C766
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040B044 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 73%
                                                                                          			E0040B044(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t61);
				_push(0x40b104);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L00403730();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E0040858C( &_v20, 4,  &_v16);
				E0040873C(_t44, _v20, _v8);
				_t29 = E0040AEF4( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E0040858C( &_v24, 4,  &_v16);
					E0040873C(_t44, _v24, _v8);
					_t40 = E0040AEF4( *_t44, _t44); // executed
					if(_t40 == 0) {
						E00407A20(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E0040B10B);
				E00407A80( &_v24, 2);
				return E00407A20( &_v8);
			}













                                                                                          0x0040b04a
                                                                                          0x0040b04d
                                                                                          0x0040b050
                                                                                          0x0040b053
                                                                                          0x0040b055
                                                                                          0x0040b05b
                                                                                          0x0040b062
                                                                                          0x0040b063
                                                                                          0x0040b068
                                                                                          0x0040b06b
                                                                                          0x0040b070
                                                                                          0x0040b076
                                                                                          0x0040b07f
                                                                                          0x0040b08f
                                                                                          0x0040b09c
                                                                                          0x0040b0a3
                                                                                          0x0040b0aa
                                                                                          0x0040b0ac
                                                                                          0x0040b0bd
                                                                                          0x0040b0ca
                                                                                          0x0040b0d1
                                                                                          0x0040b0d8
                                                                                          0x0040b0dc
                                                                                          0x0040b0dc
                                                                                          0x0040b0d8
                                                                                          0x0040b0e3
                                                                                          0x0040b0e6
                                                                                          0x0040b0e9
                                                                                          0x0040b0f6
                                                                                          0x0040b103

                                                                                          APIs
                                                                                          • GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040B104,?,?), ref: 0040B076
                                                                                          • GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040B104,?,?), ref: 0040B07F
                                                                                            • Part of subcall function 0040AEF4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040AF52,?,?), ref: 0040AF27
                                                                                            • Part of subcall function 0040AEF4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040AF52,?,?), ref: 0040AF37
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
                                                                                          • String ID:
                                                                                          • API String ID: 3216391948-0
                                                                                          • Opcode ID: 044937d21d1936a91ef9b6e1a310017a9e27582e27e23f6d989339badd03c388
                                                                                          • Instruction ID: a9cfc37755e84068b6e5d0711ea0537dd567252b91127d2e7da10f621904fc04
                                                                                          • Opcode Fuzzy Hash: 044937d21d1936a91ef9b6e1a310017a9e27582e27e23f6d989339badd03c388
                                                                                          • Instruction Fuzzy Hash: 35113674A041099BDB00EB95C9529AEB3B9EF44304F50447FA515B73C1DB785E058A6E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040AEF4 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 46%
                                                                                          			E0040AEF4(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t27);
				_push(0x40af52);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E004084EC(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E0040AF59);
				return E00407A20( &_v8);
			}








                                                                                          0x0040aefd
                                                                                          0x0040aefe
                                                                                          0x0040af04
                                                                                          0x0040af0b
                                                                                          0x0040af0c
                                                                                          0x0040af11
                                                                                          0x0040af14
                                                                                          0x0040af27
                                                                                          0x0040af34
                                                                                          0x0040af37
                                                                                          0x0040af37
                                                                                          0x0040af3e
                                                                                          0x0040af41
                                                                                          0x0040af44
                                                                                          0x0040af51

                                                                                          APIs
                                                                                          • FindFirstFileW.KERNEL32(00000000,?,00000000,0040AF52,?,?), ref: 0040AF27
                                                                                          • FindClose.KERNEL32(00000000,00000000,?,00000000,0040AF52,?,?), ref: 0040AF37
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseFileFirst
                                                                                          • String ID:
                                                                                          • API String ID: 2295610775-0
                                                                                          • Opcode ID: bba38ffe097e2c5d51b68bca4dd41d34791c3125f335f0c7ddbac3aaaf9dd96f
                                                                                          • Instruction ID: b27eefbf95a445daf5872925c41aeb1c7ded3ce7930a436f9b8cfd192dc84724
                                                                                          • Opcode Fuzzy Hash: bba38ffe097e2c5d51b68bca4dd41d34791c3125f335f0c7ddbac3aaaf9dd96f
                                                                                          • Instruction Fuzzy Hash: 5FF0B471518209BFC710FB75CD4294EB7ACEB043147A005B6B504F32C1E638AF149519
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040AB18 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173registryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 78%
                                                                                          			E0040AB18(char __eax, void* __ebx, void* __ecx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t106;
				intOrPtr _t108;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t112);
				_push(0x40ad3d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				if(_v8 != 0) {
					E0040A34C( &_v542, E004084EC(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(E0040AD44);
					return E00407A20( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t112);
						_push(0x40ad20);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						E0040A928( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E0040AE30, 0, 0, 0,  &_v20) == 0) {
								_v12 = E004053F0(_v20);
								RegQueryValueExW(_v16, E0040AE30, 0, 0, _v12,  &_v20);
								E00408550(_t97, _v12);
							}
						} else {
							_v12 = E004053F0(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E00408550(_t97, _v12);
						}
						_pop(_t108);
						 *[fs:eax] = _t108;
						_push(E0040AD27);
						if(_v12 != 0) {
							E0040540C(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}




















                                                                                          0x0040ab19
                                                                                          0x0040ab1b
                                                                                          0x0040ab22
                                                                                          0x0040ab24
                                                                                          0x0040ab2a
                                                                                          0x0040ab31
                                                                                          0x0040ab32
                                                                                          0x0040ab37
                                                                                          0x0040ab3a
                                                                                          0x0040ab41
                                                                                          0x0040ab6d
                                                                                          0x0040ab43
                                                                                          0x0040ab51
                                                                                          0x0040ab51
                                                                                          0x0040ab7a
                                                                                          0x0040ad27
                                                                                          0x0040ad29
                                                                                          0x0040ad2c
                                                                                          0x0040ad2f
                                                                                          0x0040ad3c
                                                                                          0x0040ab80
                                                                                          0x0040ab82
                                                                                          0x0040ab9a
                                                                                          0x0040aba1
                                                                                          0x0040ac41
                                                                                          0x0040ac43
                                                                                          0x0040ac44
                                                                                          0x0040ac49
                                                                                          0x0040ac4c
                                                                                          0x0040ac5a
                                                                                          0x0040ac7b
                                                                                          0x0040acca
                                                                                          0x0040acd4
                                                                                          0x0040acec
                                                                                          0x0040acf6
                                                                                          0x0040acf6
                                                                                          0x0040ac7d
                                                                                          0x0040ac85
                                                                                          0x0040ac9f
                                                                                          0x0040aca9
                                                                                          0x0040aca9
                                                                                          0x0040acfd
                                                                                          0x0040ad00
                                                                                          0x0040ad03
                                                                                          0x0040ad0c
                                                                                          0x0040ad11
                                                                                          0x0040ad11
                                                                                          0x0040ad1f
                                                                                          0x0040aba7
                                                                                          0x0040abbc
                                                                                          0x0040abc3
                                                                                          0x00000000
                                                                                          0x0040abc5
                                                                                          0x0040abda
                                                                                          0x0040abe1
                                                                                          0x00000000
                                                                                          0x0040abe3
                                                                                          0x0040abf8
                                                                                          0x0040abff
                                                                                          0x00000000
                                                                                          0x0040ac01
                                                                                          0x0040ac16
                                                                                          0x0040ac1d
                                                                                          0x00000000
                                                                                          0x0040ac1f
                                                                                          0x0040ac34
                                                                                          0x0040ac3b
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040ac3b
                                                                                          0x0040ac1d
                                                                                          0x0040abff
                                                                                          0x0040abe1
                                                                                          0x0040abc3
                                                                                          0x0040aba1

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AD3D,?,?), ref: 0040AB51
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D,?,?), ref: 0040AB9A
                                                                                          • RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D,?,?), ref: 0040ABBC
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040ABDA
                                                                                          • RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040ABF8
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040AC16
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040AC34
                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D), ref: 0040AC74
                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001), ref: 0040AC9F
                                                                                          • RegCloseKey.ADVAPI32(?,0040AD27,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001,Software\Embarcadero\Locales), ref: 0040AD1A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open$QueryValue$CloseFileModuleName
                                                                                          • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
                                                                                          • API String ID: 2701450724-3496071916
                                                                                          • Opcode ID: 8af598c5208afc10239ec938650b713086258bd8f52ea94da89803fd33d180c8
                                                                                          • Instruction ID: cdbeddac4db4dda9279672c2614f8dce2a18b15a4a55f9a64fe791b6da82c449
                                                                                          • Opcode Fuzzy Hash: 8af598c5208afc10239ec938650b713086258bd8f52ea94da89803fd33d180c8
                                                                                          • Instruction Fuzzy Hash: FB514371A80308BEEB10DA95CC46FAE77BCEB08709F504477BA04F75C1D6B8AA50975E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004B63A1 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 103COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 85%
                                                                                          			E004B63A1(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				intOrPtr _t19;
				struct HWND__* _t21;
				struct HWND__* _t22;
				struct HWND__* _t25;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t39;
				int _t40;
				intOrPtr _t41;
				intOrPtr _t43;
				struct HWND__* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t73;
				void* _t74;

				_t74 = __eflags;
				_t72 = __esi;
				_t71 = __edi;
				_t52 = __ebx;
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t17 =  *0x4c1d88; // 0x0
				 *0x4c1d88 = 0;
				E00405CE8(_t17);
				_t19 =  *0x4be634; // 0x400000
				_t21 = E0040E450(0, L"STATIC", 0, _t19, 0, 0, 0, 0, 0, 0, 0); // executed
				 *0x4ba450 = _t21;
				_t22 =  *0x4ba450; // 0x140394
				 *0x4c1d80 = SetWindowLongW(_t22, 0xfffffffc, E004AF69C);
				_t25 =  *0x4ba450; // 0x140394
				 *(_t73 - 0x58) = _t25;
				 *((char*)(_t73 - 0x54)) = 0;
				_t26 =  *0x4c1d90; // 0x4e0234
				_t4 = _t26 + 0x20; // 0x2724da
				 *((intOrPtr*)(_t73 - 0x50)) =  *_t4;
				 *((char*)(_t73 - 0x4c)) = 0;
				_t28 =  *0x4c1d90; // 0x4e0234
				_t7 = _t28 + 0x24; // 0xd4200
				 *((intOrPtr*)(_t73 - 0x48)) =  *_t7;
				 *((char*)(_t73 - 0x44)) = 0;
				E0041A87C(L"/SL5=\"$%x,%d,%d,", 2, _t73 - 0x58, _t73 - 0x40);
				_push( *((intOrPtr*)(_t73 - 0x40)));
				_push( *0x4c1d84);
				_push(0x4b6680);
				E00422BC4(_t73 - 0x5c, __ebx, __esi, _t74);
				_push( *((intOrPtr*)(_t73 - 0x5c)));
				E004087C4(_t73 - 0x3c, __ebx, 4, __edi, __esi);
				_t36 =  *0x4c1d9c; // 0x22c4c4c, executed
				E004AF728(_t36, _t52, 0x4ba44c,  *((intOrPtr*)(_t73 - 0x3c)), _t71, _t72, __fp0); // executed
				if( *0x4ba448 != 0xffffffff) {
					_t50 =  *0x4ba448; // 0x0
					E004AF60C(_t50);
				}
				_pop(_t68);
				 *[fs:eax] = _t68;
				_push(E004B6554);
				_t39 =  *0x4c1d88; // 0x0
				_t40 = E00405CE8(_t39);
				if( *0x4c1d9c != 0) {
					_t70 =  *0x4c1d9c; // 0x22c4c4c
					_t40 = E004AF1B4(0, _t70, 0xfa, 0x32);
				}
				if( *0x4c1d94 != 0) {
					_t47 =  *0x4c1d94; // 0x22a7f8c
					_t40 = RemoveDirectoryW(E004084EC(_t47));
				}
				if( *0x4ba450 != 0) {
					_t46 =  *0x4ba450; // 0x140394
					_t40 = DestroyWindow(_t46);
				}
				if( *0x4c1d78 != 0) {
					_t41 =  *0x4c1d78; // 0x2336888
					_t60 =  *0x4c1d7c; // 0x1
					_t69 =  *0x426bb0; // 0x426bb4
					E00408D08(_t41, _t60, _t69);
					_t43 =  *0x4c1d78; // 0x2336888
					E0040540C(_t43);
					 *0x4c1d78 = 0;
					return 0;
				}
				return _t40;
			}

























                                                                                          0x004b63a1
                                                                                          0x004b63a1
                                                                                          0x004b63a1
                                                                                          0x004b63a1
                                                                                          0x004b63a3
                                                                                          0x004b63a6
                                                                                          0x004b63d3
                                                                                          0x004b63da
                                                                                          0x004b63e0
                                                                                          0x004b63f3
                                                                                          0x004b6407
                                                                                          0x004b640c
                                                                                          0x004b6418
                                                                                          0x004b6423
                                                                                          0x004b642c
                                                                                          0x004b6431
                                                                                          0x004b6434
                                                                                          0x004b6438
                                                                                          0x004b643d
                                                                                          0x004b6440
                                                                                          0x004b6443
                                                                                          0x004b6447
                                                                                          0x004b644c
                                                                                          0x004b644f
                                                                                          0x004b6452
                                                                                          0x004b6463
                                                                                          0x004b6468
                                                                                          0x004b646b
                                                                                          0x004b6471
                                                                                          0x004b6479
                                                                                          0x004b647e
                                                                                          0x004b6489
                                                                                          0x004b6496
                                                                                          0x004b649b
                                                                                          0x004b64a7
                                                                                          0x004b64a9
                                                                                          0x004b64ae
                                                                                          0x004b64ae
                                                                                          0x004b64b5
                                                                                          0x004b64b8
                                                                                          0x004b64bb
                                                                                          0x004b64c0
                                                                                          0x004b64c5
                                                                                          0x004b64d1
                                                                                          0x004b64df
                                                                                          0x004b64e7
                                                                                          0x004b64e7
                                                                                          0x004b64f3
                                                                                          0x004b64f5
                                                                                          0x004b6500
                                                                                          0x004b6500
                                                                                          0x004b650c
                                                                                          0x004b650e
                                                                                          0x004b6514
                                                                                          0x004b6514
                                                                                          0x004b6520
                                                                                          0x004b6522
                                                                                          0x004b6527
                                                                                          0x004b652d
                                                                                          0x004b6533
                                                                                          0x004b6538
                                                                                          0x004b653d
                                                                                          0x004b6544
                                                                                          0x00000000
                                                                                          0x004b6544
                                                                                          0x004b6549

                                                                                          APIs
                                                                                            • Part of subcall function 0040E450: CreateWindowExW.USER32 ref: 0040E48F
                                                                                          • SetWindowLongW.USER32(00140394,000000FC,004AF69C), ref: 004B641E
                                                                                            • Part of subcall function 00422BC4: GetCommandLineW.KERNEL32(00000000,00422C06,?,?,00000000,?,004B647E,004B6680,?), ref: 00422BDA
                                                                                            • Part of subcall function 004AF728: CreateProcessW.KERNEL32 ref: 004AF798
                                                                                            • Part of subcall function 004AF728: CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004AF82C,022C4C4C,004AF81C,00000000), ref: 004AF7AE
                                                                                            • Part of subcall function 004AF728: MsgWaitForMultipleObjects.USER32 ref: 004AF7C7
                                                                                            • Part of subcall function 004AF728: GetExitCodeProcess.KERNEL32 ref: 004AF7DB
                                                                                            • Part of subcall function 004AF728: CloseHandle.KERNEL32(?,?,004BA44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004AF7E4
                                                                                          • RemoveDirectoryW.KERNEL32(00000000,004B6554), ref: 004B6500
                                                                                          • DestroyWindow.USER32(00140394,004B6554), ref: 004B6514
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
                                                                                          • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$MZP$STATIC
                                                                                          • API String ID: 3586484885-2992229532
                                                                                          • Opcode ID: 3c021837c984efc67f9ad3a794955b0d04b23bc85077f6812c73bb0a86195aee
                                                                                          • Instruction ID: 04c90e22d0408fd8de4b79ff2beaee59f7a3a861a1d73b16261182ae62401715
                                                                                          • Opcode Fuzzy Hash: 3c021837c984efc67f9ad3a794955b0d04b23bc85077f6812c73bb0a86195aee
                                                                                          • Instruction Fuzzy Hash: EC416B74A002009FE754EBA9EC85B9A37B4EB85308F11453BE0059B2B6CB7CA851CB5D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040426C Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 150 40426c-40427b 151 404281-404285 150->151 152 404364-404367 150->152 153 404287-40428e 151->153 154 4042e8-4042f1 151->154 155 404454-404458 152->155 156 40436d-404377 152->156 160 404290-40429b 153->160 161 4042bc-4042be 153->161 154->153 159 4042f3-4042fc 154->159 157 403cf8-403d1d call 403c48 155->157 158 40445e-404463 155->158 162 404328-404335 156->162 163 404379-404385 156->163 183 403d39-403d40 157->183 184 403d1f-403d2e VirtualFree 157->184 159->154 166 4042fe-404312 Sleep 159->166 169 4042a4-4042b9 160->169 170 40429d-4042a2 160->170 164 4042c0-4042d1 161->164 165 4042d3 161->165 162->163 167 404337-404340 162->167 171 404387-40438a 163->171 172 4043bc-4043ca 163->172 164->165 174 4042d6-4042e3 164->174 165->174 166->153 176 404318-404323 Sleep 166->176 167->162 177 404342-404356 Sleep 167->177 173 40438e-404392 171->173 172->173 175 4043cc-4043d1 call 403ac0 172->175 179 4043d4-4043e1 173->179 180 404394-40439a 173->180 174->156 175->173 176->154 177->163 182 404358-40435f Sleep 177->182 179->180 191 4043e3-4043ea call 403ac0 179->191 187 4043ec-4043f6 180->187 188 40439c-4043ba call 403b00 180->188 182->162 189 403d42-403d5e VirtualQuery VirtualFree 183->189 185 403d30-403d32 184->185 186 403d34-403d37 184->186 192 403d73-403d75 185->192 186->192 197 404424-404451 call 403b60 187->197 198 4043f8-404420 VirtualFree 187->198 194 403d60-403d63 189->194 195 403d65-403d6b 189->195 191->180 202 403d77-403d87 192->202 203 403d8a-403d9a 192->203 194->192 195->192 201 403d6d-403d71 195->201 201->189 202->203
                                                                                          C-Code - Quality: 91%
                                                                                          			E0040426C(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x4bb059; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00403C48();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x4bdb78 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x4bb989;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x4bb059; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x4bbae8], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x4bb989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x4bbaf0 - 0x13ffe0;
							if( *0x4bbaf0 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00403B60(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x4bbaf0 = 0x13ffe0;
								 *0x4bbaec = _t82;
								 *0x4bbae8 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x4bbae8 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00403B00(_t106, _t88, _t81);
							 *0x4bbae8 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}





























                                                                                          0x0040426c
                                                                                          0x0040426c
                                                                                          0x00404275
                                                                                          0x0040427b
                                                                                          0x00404364
                                                                                          0x00404367
                                                                                          0x00404454
                                                                                          0x00404455
                                                                                          0x00404458
                                                                                          0x00403cf8
                                                                                          0x00403cfa
                                                                                          0x00403cfc
                                                                                          0x00403d01
                                                                                          0x00403d04
                                                                                          0x00403d09
                                                                                          0x00403d0d
                                                                                          0x00403d13
                                                                                          0x00403d17
                                                                                          0x00403d1d
                                                                                          0x00403d39
                                                                                          0x00403d3d
                                                                                          0x00403d40
                                                                                          0x00403d40
                                                                                          0x00403d42
                                                                                          0x00403d4a
                                                                                          0x00403d57
                                                                                          0x00403d5c
                                                                                          0x00403d5e
                                                                                          0x00403d60
                                                                                          0x00403d63
                                                                                          0x00403d63
                                                                                          0x00403d65
                                                                                          0x00403d69
                                                                                          0x00403d6b
                                                                                          0x00403d6d
                                                                                          0x00403d6f
                                                                                          0x00000000
                                                                                          0x00403d6f
                                                                                          0x00000000
                                                                                          0x00403d6b
                                                                                          0x00403d1f
                                                                                          0x00403d27
                                                                                          0x00403d2e
                                                                                          0x00403d34
                                                                                          0x00403d30
                                                                                          0x00403d30
                                                                                          0x00403d30
                                                                                          0x00403d2e
                                                                                          0x00403d73
                                                                                          0x00403d75
                                                                                          0x00403d7e
                                                                                          0x00403d87
                                                                                          0x00403d87
                                                                                          0x00403d8a
                                                                                          0x00403d9a
                                                                                          0x0040445e
                                                                                          0x00404463
                                                                                          0x00404463
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00404281
                                                                                          0x00404281
                                                                                          0x00404283
                                                                                          0x00404285
                                                                                          0x004042e8
                                                                                          0x004042e8
                                                                                          0x004042ed
                                                                                          0x004042f1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004042f3
                                                                                          0x004042f5
                                                                                          0x004042fc
                                                                                          0x00000000
                                                                                          0x004042fe
                                                                                          0x00404302
                                                                                          0x00404307
                                                                                          0x00404308
                                                                                          0x00404309
                                                                                          0x0040430e
                                                                                          0x00404312
                                                                                          0x0040431c
                                                                                          0x00404321
                                                                                          0x00404322
                                                                                          0x00000000
                                                                                          0x00404322
                                                                                          0x00404312
                                                                                          0x00000000
                                                                                          0x004042fc
                                                                                          0x004042e8
                                                                                          0x00404287
                                                                                          0x00404287
                                                                                          0x00404287
                                                                                          0x00404287
                                                                                          0x0040428b
                                                                                          0x0040428e
                                                                                          0x004042bc
                                                                                          0x004042be
                                                                                          0x004042d3
                                                                                          0x004042d3
                                                                                          0x004042c0
                                                                                          0x004042c0
                                                                                          0x004042c3
                                                                                          0x004042c6
                                                                                          0x004042c9
                                                                                          0x004042cc
                                                                                          0x004042ce
                                                                                          0x004042d1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004042d1
                                                                                          0x004042d6
                                                                                          0x004042d8
                                                                                          0x004042da
                                                                                          0x004042dd
                                                                                          0x0040436d
                                                                                          0x00404370
                                                                                          0x00404372
                                                                                          0x00404374
                                                                                          0x00404375
                                                                                          0x00404377
                                                                                          0x00404328
                                                                                          0x00404328
                                                                                          0x0040432d
                                                                                          0x00404335
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00404337
                                                                                          0x00404339
                                                                                          0x00404340
                                                                                          0x00000000
                                                                                          0x00404342
                                                                                          0x00404344
                                                                                          0x00404349
                                                                                          0x0040434e
                                                                                          0x00404356
                                                                                          0x0040435a
                                                                                          0x00000000
                                                                                          0x0040435a
                                                                                          0x00404356
                                                                                          0x00000000
                                                                                          0x00404340
                                                                                          0x00404328
                                                                                          0x00404379
                                                                                          0x00404379
                                                                                          0x00404381
                                                                                          0x00404385
                                                                                          0x004043bc
                                                                                          0x004043bf
                                                                                          0x004043c2
                                                                                          0x004043c4
                                                                                          0x004043ca
                                                                                          0x004043cc
                                                                                          0x004043cc
                                                                                          0x00404387
                                                                                          0x00404387
                                                                                          0x00404387
                                                                                          0x0040438a
                                                                                          0x0040438a
                                                                                          0x0040438e
                                                                                          0x00404392
                                                                                          0x004043d4
                                                                                          0x004043d7
                                                                                          0x004043d9
                                                                                          0x004043db
                                                                                          0x004043e1
                                                                                          0x004043e5
                                                                                          0x004043e5
                                                                                          0x004043e1
                                                                                          0x00404394
                                                                                          0x0040439a
                                                                                          0x004043ec
                                                                                          0x004043f6
                                                                                          0x00404424
                                                                                          0x0040442a
                                                                                          0x0040442f
                                                                                          0x00404436
                                                                                          0x00404440
                                                                                          0x00404446
                                                                                          0x0040444d
                                                                                          0x00404451
                                                                                          0x004043f8
                                                                                          0x004043f8
                                                                                          0x004043fb
                                                                                          0x004043fd
                                                                                          0x00404400
                                                                                          0x00404403
                                                                                          0x00404405
                                                                                          0x00404414
                                                                                          0x00404419
                                                                                          0x0040441c
                                                                                          0x00404420
                                                                                          0x00404420
                                                                                          0x0040439c
                                                                                          0x0040439f
                                                                                          0x004043a2
                                                                                          0x004043aa
                                                                                          0x004043af
                                                                                          0x004043b6
                                                                                          0x004043ba
                                                                                          0x004043ba
                                                                                          0x00404290
                                                                                          0x00404290
                                                                                          0x00404292
                                                                                          0x00404298
                                                                                          0x0040429b
                                                                                          0x004042a4
                                                                                          0x004042a7
                                                                                          0x004042aa
                                                                                          0x004042ad
                                                                                          0x004042b0
                                                                                          0x004042b3
                                                                                          0x004042b6
                                                                                          0x004042b6
                                                                                          0x004042b8
                                                                                          0x004042b9
                                                                                          0x0040429d
                                                                                          0x0040429d
                                                                                          0x0040429d
                                                                                          0x0040429f
                                                                                          0x004042a1
                                                                                          0x004042a2
                                                                                          0x004042a2
                                                                                          0x0040429b
                                                                                          0x0040428e

                                                                                          APIs
                                                                                          • Sleep.KERNEL32(00000000,?,?,00000000,0040BB40,0040BBA6,?,00000000,?,?,0040BEC9,00000000,?,00000000,0040C3CA,00000000), ref: 00404302
                                                                                          • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040BB40,0040BBA6,?,00000000,?,?,0040BEC9,00000000,?,00000000,0040C3CA), ref: 0040431C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: b3bd630b7a2e2282397de67d1abd0bd88a91e4ca282caa36afca3486ce457fd8
                                                                                          • Instruction ID: daf3465a9571387f72e828d046180f4ce70f3b260d456b91f151aa63c4646fa2
                                                                                          • Opcode Fuzzy Hash: b3bd630b7a2e2282397de67d1abd0bd88a91e4ca282caa36afca3486ce457fd8
                                                                                          • Instruction Fuzzy Hash: AA71E2B17042008BD715DF29CC84B16BBD8AF85715F2482BFE984AB3D2D7B899418789
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF728 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77processCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 61%
                                                                                          			E004AF728(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				struct _STARTUPINFOW _v76;
				void* _v88;
				void* _v92;
				int _t23;
				intOrPtr _t49;
				DWORD* _t51;
				void* _t56;

				_v8 = 0;
				_t51 = __ecx;
				_t53 = __edx;
				_t41 = __eax;
				_push(_t56);
				_push(0x4af7ff);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xffffffa8;
				_push(0x4af81c);
				_push(__eax);
				_push(0x4af82c);
				_push(__edx);
				E004087C4( &_v8, __eax, 4, __ecx, __edx);
				E00405884( &_v76, 0x44);
				_v76.cb = 0x44;
				_t23 = CreateProcessW(0, E004084EC(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92); // executed
				_t58 = _t23;
				if(_t23 == 0) {
					E004AF34C(0x83, _t41, 0, _t53, _t58);
				}
				CloseHandle(_v88);
				do {
					E004AF6FC();
				} while (MsgWaitForMultipleObjects(1,  &_v92, 0, 0xffffffff, 0x4ff) == 1);
				E004AF6FC();
				GetExitCodeProcess(_v92, _t51);
				CloseHandle(_v92);
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(0x4af806);
				return E00407A20( &_v8);
			}











                                                                                          0x004af733
                                                                                          0x004af736
                                                                                          0x004af738
                                                                                          0x004af73a
                                                                                          0x004af73e
                                                                                          0x004af73f
                                                                                          0x004af744
                                                                                          0x004af747
                                                                                          0x004af74a
                                                                                          0x004af74f
                                                                                          0x004af750
                                                                                          0x004af755
                                                                                          0x004af75e
                                                                                          0x004af76d
                                                                                          0x004af772
                                                                                          0x004af798
                                                                                          0x004af79d
                                                                                          0x004af79f
                                                                                          0x004af7a5
                                                                                          0x004af7a5
                                                                                          0x004af7ae
                                                                                          0x004af7b3
                                                                                          0x004af7b3
                                                                                          0x004af7cc
                                                                                          0x004af7d1
                                                                                          0x004af7db
                                                                                          0x004af7e4
                                                                                          0x004af7eb
                                                                                          0x004af7ee
                                                                                          0x004af7f1
                                                                                          0x004af7fe

                                                                                          APIs
                                                                                          • CreateProcessW.KERNEL32 ref: 004AF798
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004AF82C,022C4C4C,004AF81C,00000000), ref: 004AF7AE
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 004AF7C7
                                                                                          • GetExitCodeProcess.KERNEL32 ref: 004AF7DB
                                                                                          • CloseHandle.KERNEL32(?,?,004BA44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004AF7E4
                                                                                            • Part of subcall function 004AF34C: GetLastError.KERNEL32(00000000,004AF3F5,?,?,022C4C4C), ref: 004AF36F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
                                                                                          • String ID: D
                                                                                          • API String ID: 3356880605-2746444292
                                                                                          • Opcode ID: ad1163668f60b09aa263e635df1463f1e4b37e8a5aa9c4cbf2e159c77cef0046
                                                                                          • Instruction ID: 88989adc3f1fa39a5a5eb6990527994e2deb527bcdcae90bffb7d35c0d41af56
                                                                                          • Opcode Fuzzy Hash: ad1163668f60b09aa263e635df1463f1e4b37e8a5aa9c4cbf2e159c77cef0046
                                                                                          • Instruction Fuzzy Hash: C01163716041096EEB00FBE68C42F9F77ACDF56714F50053AB604E72C5DA789905866D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004B5A90 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 60%
                                                                                          			E004B5A90(void* __ebx, void* __ecx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _t16;
				intOrPtr _t32;
				intOrPtr _t41;

				_t27 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(_t41);
				_push(0x4b5b5a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				 *0x4c1124 =  *0x4c1124 - 1;
				if( *0x4c1124 < 0) {
					 *0x4c1128 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64DisableWow64FsRedirection");
					 *0x4c112c = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64RevertWow64FsRedirection");
					if( *0x4c1128 == 0 ||  *0x4c112c == 0) {
						_t16 = 0;
					} else {
						_t16 = 1;
					}
					 *0x4c1130 = _t16;
					E00422D44( &_v12);
					E00422660(_v12,  &_v8);
					E004086E4( &_v8, L"shell32.dll");
					E00421230(_v8, _t27, 0x8000); // executed
					E004232EC(0x4c783afb,  &_v16);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(0x4b5b61);
				return E00407A80( &_v16, 3);
			}









                                                                                          0x004b5a90
                                                                                          0x004b5a93
                                                                                          0x004b5a95
                                                                                          0x004b5a97
                                                                                          0x004b5a9b
                                                                                          0x004b5a9c
                                                                                          0x004b5aa1
                                                                                          0x004b5aa4
                                                                                          0x004b5aa7
                                                                                          0x004b5aae
                                                                                          0x004b5ac9
                                                                                          0x004b5ae3
                                                                                          0x004b5aef
                                                                                          0x004b5afa
                                                                                          0x004b5afe
                                                                                          0x004b5afe
                                                                                          0x004b5afe
                                                                                          0x004b5b00
                                                                                          0x004b5b08
                                                                                          0x004b5b13
                                                                                          0x004b5b20
                                                                                          0x004b5b2d
                                                                                          0x004b5b3a
                                                                                          0x004b5b3a
                                                                                          0x004b5b41
                                                                                          0x004b5b44
                                                                                          0x004b5b47
                                                                                          0x004b5b59

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004B5B5A,?,00000000,00000000,00000000), ref: 004B5ABE
                                                                                            • Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004B5B5A,?,00000000,00000000,00000000), ref: 004B5AD8
                                                                                            • Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00000000), ref: 0040E20B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                          • API String ID: 1646373207-2130885113
                                                                                          • Opcode ID: 149d4641e6716bccfc7038b8b83dc43c2c59674e16c2d4af6eff100d23c955b7
                                                                                          • Instruction ID: b56c6da1e02aeac4ac36a9fb763b3b3a2bfa4c382daca5c5ea2a5d16c2919690
                                                                                          • Opcode Fuzzy Hash: 149d4641e6716bccfc7038b8b83dc43c2c59674e16c2d4af6eff100d23c955b7
                                                                                          • Instruction Fuzzy Hash: DA11A730604704AFD744EB76DC02F9DB7B4E749704F64447BF500A6591CABC6A04CA3D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00403EE8 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 246 403ee8-403efa 247 403f00-403f10 246->247 248 404148-40414d 246->248 249 403f12-403f1f 247->249 250 403f68-403f71 247->250 251 404260-404263 248->251 252 404153-404164 248->252 255 403f21-403f2e 249->255 256 403f38-403f44 249->256 250->249 257 403f73-403f7f 250->257 253 403c94-403cbd VirtualAlloc 251->253 254 404269-40426b 251->254 258 404166-404182 252->258 259 40410c-404119 252->259 266 403cef-403cf5 253->266 267 403cbf-403cec call 403c48 253->267 260 403f30-403f34 255->260 261 403f58-403f65 255->261 262 403f46-403f54 256->262 263 403fbc-403fc5 256->263 257->249 265 403f81-403f8d 257->265 268 404190-40419f 258->268 269 404184-40418c 258->269 259->258 264 40411b-404124 259->264 270 404000-40400a 263->270 271 403fc7-403fd4 263->271 264->259 272 404126-40413a Sleep 264->272 265->249 273 403f8f-403f9b 265->273 267->266 276 4041a1-4041b5 268->276 277 4041b8-4041c0 268->277 275 4041ec-404202 269->275 281 40407c-404088 270->281 282 40400c-404037 270->282 271->270 278 403fd6-403fdf 271->278 272->258 285 40413c-404143 Sleep 272->285 273->250 286 403f9d-403fad Sleep 273->286 283 404204-404212 275->283 284 40421b-404227 275->284 276->275 279 4041c2-4041da 277->279 280 4041dc-4041de call 403bcc 277->280 278->271 288 403fe1-403ff5 Sleep 278->288 289 4041e3-4041eb 279->289 280->289 296 4040b0-4040bf call 403bcc 281->296 297 40408a-40409c 281->297 291 404050-40405e 282->291 292 404039-404047 282->292 283->284 293 404214 283->293 294 404248 284->294 295 404229-40423c 284->295 285->259 286->249 298 403fb3-403fba Sleep 286->298 288->270 300 403ff7-403ffe Sleep 288->300 302 404060-40407a call 403b00 291->302 303 4040cc 291->303 292->291 301 404049 292->301 293->284 304 40424d-40425f 294->304 295->304 305 40423e-404243 call 403b00 295->305 308 4040d1-40410a 296->308 312 4040c1-4040cb 296->312 306 4040a0-4040ae 297->306 307 40409e 297->307 298->250 300->271 301->291 302->308 303->308 305->304 306->308 307->306
                                                                                          C-Code - Quality: 68%
                                                                                          			E00403EE8(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t95 = __eax;
				_t129 =  *0x4bb059; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t2 = _t162 + 0x10010; // 0x10110
							_t156 = _t2 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00403C48();
								_t99 =  *0x4bdb80; // 0x4bdb7c
								 *_t147 = 0x4bdb7c;
								 *0x4bdb80 = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x4bdb78 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t67 = _t95 + 0xd3; // 0x1d3
						_t125 = (_t67 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x4bbae8], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x4bb989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t68 = _t125 - 0xb30; // -2445
						_t141 = _t68;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x4bbaf8 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x4bbaf4;
							if((0xfffffffe << _t132 &  *0x4bbaf4) == 0) {
								_t133 =  *0x4bbaf0; // 0x1eb90
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E00403BCC(_t125);
								} else {
									_t110 =  *0x4bbaec; // 0x224eba0
									_t109 = _t110 - _t125;
									 *0x4bbaec = _t109;
									 *0x4bbaf0 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x4bbae8 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x4bbb78 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x4bbaf8 + _t142 * 4;
								 *_t80 =  *(0x4bbaf8 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x4bbaf4], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00403B00(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							_t93 = _t125 + 2; // 0x1a5
							 *(_t159 - 4) = _t93;
							 *0x4bbae8 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					_t6 = __edx + 0x4bb990; // 0xc8c8c8c8
					__eax =  *_t6 & 0x000000ff;
					__ebx = 0x4b7080 + ( *_t6 & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x4bb989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x4bb059;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x4bb989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x4bbae8], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x4bbaf4;
							__eflags =  *(__ebx + 1) &  *0x4bbaf4;
							if(( *(__ebx + 1) &  *0x4bbaf4) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x4bbaf0; // 0x1eb90
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E00403BCC(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x4bbae8 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x4bbaec; // 0x224eba0
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x4bbaf0 =  *0x4bbaf0 - __edi;
									 *0x4bbaec = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x4bbaf8 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x4bbaf8 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x4bbb78 + ( *(0x4bbaf8 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x4bbaf8 + __eax * 4;
									 *_t38 =  *(0x4bbaf8 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x4bbaf4], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00403B00(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0x1eb96
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x4bbae8 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x224ebc0
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}






























                                                                                          0x00403ee8
                                                                                          0x00403ef4
                                                                                          0x00403efa
                                                                                          0x00404148
                                                                                          0x0040414d
                                                                                          0x00404260
                                                                                          0x00404261
                                                                                          0x00404263
                                                                                          0x00403c94
                                                                                          0x00403c98
                                                                                          0x00403c9a
                                                                                          0x00403ca4
                                                                                          0x00403cb4
                                                                                          0x00403cb9
                                                                                          0x00403cbd
                                                                                          0x00403cbf
                                                                                          0x00403cc1
                                                                                          0x00403cc7
                                                                                          0x00403cca
                                                                                          0x00403ccf
                                                                                          0x00403cd4
                                                                                          0x00403cda
                                                                                          0x00403ce0
                                                                                          0x00403ce3
                                                                                          0x00403ce5
                                                                                          0x00403cec
                                                                                          0x00403cec
                                                                                          0x00403cf5
                                                                                          0x00404269
                                                                                          0x00404269
                                                                                          0x0040426b
                                                                                          0x0040426b
                                                                                          0x00404153
                                                                                          0x00404153
                                                                                          0x0040415f
                                                                                          0x00404162
                                                                                          0x00404164
                                                                                          0x0040410c
                                                                                          0x00404111
                                                                                          0x00404119
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040411b
                                                                                          0x0040411d
                                                                                          0x00404124
                                                                                          0x00000000
                                                                                          0x00404126
                                                                                          0x00404128
                                                                                          0x00404132
                                                                                          0x0040413a
                                                                                          0x0040413e
                                                                                          0x00000000
                                                                                          0x0040413e
                                                                                          0x0040413a
                                                                                          0x00000000
                                                                                          0x00404124
                                                                                          0x0040410c
                                                                                          0x00404166
                                                                                          0x00404166
                                                                                          0x00404166
                                                                                          0x0040416e
                                                                                          0x00404171
                                                                                          0x0040417b
                                                                                          0x0040417b
                                                                                          0x00404182
                                                                                          0x00404195
                                                                                          0x00404199
                                                                                          0x0040419f
                                                                                          0x004041b8
                                                                                          0x004041be
                                                                                          0x004041be
                                                                                          0x004041c0
                                                                                          0x004041de
                                                                                          0x004041c2
                                                                                          0x004041c2
                                                                                          0x004041c7
                                                                                          0x004041c9
                                                                                          0x004041ce
                                                                                          0x004041d7
                                                                                          0x004041d7
                                                                                          0x004041e3
                                                                                          0x004041eb
                                                                                          0x004041a1
                                                                                          0x004041a1
                                                                                          0x004041ab
                                                                                          0x004041b3
                                                                                          0x00000000
                                                                                          0x004041b3
                                                                                          0x00404184
                                                                                          0x00404187
                                                                                          0x0040418a
                                                                                          0x004041ec
                                                                                          0x004041ec
                                                                                          0x004041ed
                                                                                          0x004041ee
                                                                                          0x004041f5
                                                                                          0x004041f8
                                                                                          0x004041fb
                                                                                          0x004041fe
                                                                                          0x00404200
                                                                                          0x00404202
                                                                                          0x00404209
                                                                                          0x0040420b
                                                                                          0x0040420b
                                                                                          0x0040420b
                                                                                          0x00404212
                                                                                          0x00404214
                                                                                          0x00404214
                                                                                          0x00404212
                                                                                          0x00404220
                                                                                          0x00404225
                                                                                          0x00404225
                                                                                          0x00404227
                                                                                          0x00404248
                                                                                          0x00404248
                                                                                          0x00404248
                                                                                          0x00404229
                                                                                          0x00404229
                                                                                          0x0040422f
                                                                                          0x00404232
                                                                                          0x00404236
                                                                                          0x0040423c
                                                                                          0x0040423e
                                                                                          0x0040423e
                                                                                          0x0040423c
                                                                                          0x0040424d
                                                                                          0x00404250
                                                                                          0x00404253
                                                                                          0x0040425f
                                                                                          0x0040425f
                                                                                          0x00404182
                                                                                          0x00403f00
                                                                                          0x00403f00
                                                                                          0x00403f02
                                                                                          0x00403f02
                                                                                          0x00403f09
                                                                                          0x00403f10
                                                                                          0x00403f68
                                                                                          0x00403f68
                                                                                          0x00403f6d
                                                                                          0x00403f71
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00403f73
                                                                                          0x00403f73
                                                                                          0x00403f76
                                                                                          0x00403f7b
                                                                                          0x00403f7f
                                                                                          0x00403f81
                                                                                          0x00403f81
                                                                                          0x00403f84
                                                                                          0x00403f89
                                                                                          0x00403f8d
                                                                                          0x00403f8f
                                                                                          0x00403f92
                                                                                          0x00403f94
                                                                                          0x00403f9b
                                                                                          0x00000000
                                                                                          0x00403f9d
                                                                                          0x00403f9f
                                                                                          0x00403fa4
                                                                                          0x00403fa9
                                                                                          0x00403fad
                                                                                          0x00403fb5
                                                                                          0x00000000
                                                                                          0x00403fb5
                                                                                          0x00403fad
                                                                                          0x00403f9b
                                                                                          0x00403f8d
                                                                                          0x00000000
                                                                                          0x00403f7f
                                                                                          0x00403f68
                                                                                          0x00403f12
                                                                                          0x00403f12
                                                                                          0x00403f15
                                                                                          0x00403f18
                                                                                          0x00403f1d
                                                                                          0x00403f1f
                                                                                          0x00403f38
                                                                                          0x00403f3b
                                                                                          0x00403f3f
                                                                                          0x00403f41
                                                                                          0x00403f44
                                                                                          0x00403fbc
                                                                                          0x00403fbd
                                                                                          0x00403fbe
                                                                                          0x00403fc5
                                                                                          0x00403fc7
                                                                                          0x00403fc7
                                                                                          0x00403fcc
                                                                                          0x00403fd4
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00403fd6
                                                                                          0x00403fd8
                                                                                          0x00403fdf
                                                                                          0x00000000
                                                                                          0x00403fe1
                                                                                          0x00403fe3
                                                                                          0x00403fe8
                                                                                          0x00403fed
                                                                                          0x00403ff5
                                                                                          0x00403ff9
                                                                                          0x00000000
                                                                                          0x00403ff9
                                                                                          0x00403ff5
                                                                                          0x00000000
                                                                                          0x00403fdf
                                                                                          0x00403fc7
                                                                                          0x00404000
                                                                                          0x00404004
                                                                                          0x00404004
                                                                                          0x0040400a
                                                                                          0x0040407c
                                                                                          0x00404080
                                                                                          0x00404086
                                                                                          0x00404088
                                                                                          0x004040b0
                                                                                          0x004040b4
                                                                                          0x004040b6
                                                                                          0x004040bb
                                                                                          0x004040bd
                                                                                          0x004040bf
                                                                                          0x00000000
                                                                                          0x004040c1
                                                                                          0x004040c1
                                                                                          0x004040c6
                                                                                          0x004040c8
                                                                                          0x004040c9
                                                                                          0x004040ca
                                                                                          0x004040cb
                                                                                          0x004040cb
                                                                                          0x0040408a
                                                                                          0x0040408a
                                                                                          0x00404090
                                                                                          0x00404094
                                                                                          0x0040409a
                                                                                          0x0040409c
                                                                                          0x0040409e
                                                                                          0x0040409e
                                                                                          0x004040a0
                                                                                          0x004040a2
                                                                                          0x004040a8
                                                                                          0x00000000
                                                                                          0x004040a8
                                                                                          0x0040400c
                                                                                          0x0040400c
                                                                                          0x0040400f
                                                                                          0x00404016
                                                                                          0x0040401d
                                                                                          0x00404020
                                                                                          0x00404023
                                                                                          0x0040402a
                                                                                          0x0040402d
                                                                                          0x00404030
                                                                                          0x00404033
                                                                                          0x00404035
                                                                                          0x00404037
                                                                                          0x00404039
                                                                                          0x0040403e
                                                                                          0x00404040
                                                                                          0x00404040
                                                                                          0x00404040
                                                                                          0x00404047
                                                                                          0x00404049
                                                                                          0x00404049
                                                                                          0x00404047
                                                                                          0x00404050
                                                                                          0x00404055
                                                                                          0x00404058
                                                                                          0x0040405e
                                                                                          0x004040cc
                                                                                          0x004040cc
                                                                                          0x004040cc
                                                                                          0x00404060
                                                                                          0x00404060
                                                                                          0x00404062
                                                                                          0x00404066
                                                                                          0x00404068
                                                                                          0x0040406b
                                                                                          0x0040406e
                                                                                          0x00404071
                                                                                          0x00404075
                                                                                          0x00404075
                                                                                          0x004040d1
                                                                                          0x004040d1
                                                                                          0x004040d1
                                                                                          0x004040d4
                                                                                          0x004040d7
                                                                                          0x004040d9
                                                                                          0x004040de
                                                                                          0x004040e0
                                                                                          0x004040e3
                                                                                          0x004040ea
                                                                                          0x004040ed
                                                                                          0x004040ed
                                                                                          0x004040f0
                                                                                          0x004040f4
                                                                                          0x004040f7
                                                                                          0x004040fa
                                                                                          0x004040fc
                                                                                          0x004040fc
                                                                                          0x004040fe
                                                                                          0x00404101
                                                                                          0x00404104
                                                                                          0x00404107
                                                                                          0x00404108
                                                                                          0x00404109
                                                                                          0x0040410a
                                                                                          0x0040410a
                                                                                          0x00403f46
                                                                                          0x00403f46
                                                                                          0x00403f46
                                                                                          0x00403f46
                                                                                          0x00403f4a
                                                                                          0x00403f4d
                                                                                          0x00403f50
                                                                                          0x00403f53
                                                                                          0x00403f54
                                                                                          0x00403f54
                                                                                          0x00403f21
                                                                                          0x00403f21
                                                                                          0x00403f25
                                                                                          0x00403f25
                                                                                          0x00403f28
                                                                                          0x00403f2b
                                                                                          0x00403f2e
                                                                                          0x00403f58
                                                                                          0x00403f5b
                                                                                          0x00403f5e
                                                                                          0x00403f61
                                                                                          0x00403f64
                                                                                          0x00403f65
                                                                                          0x00403f30
                                                                                          0x00403f30
                                                                                          0x00403f33
                                                                                          0x00403f34
                                                                                          0x00403f34
                                                                                          0x00403f2e
                                                                                          0x00403f1f

                                                                                          APIs
                                                                                          • Sleep.KERNEL32(00000000,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403F9F
                                                                                          • Sleep.KERNEL32(0000000A,00000000,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FB5
                                                                                          • Sleep.KERNEL32(00000000,00000000,?,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FE3
                                                                                          • Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FF9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: a5f41a95b234689400651ffc7a7e648ad6c8ae29c578f3c4a4f7439c6b153684
                                                                                          • Instruction ID: d98b69cfe0522def9def3360e9182a2a8bb24ce33fa39324cc86f3a67812f259
                                                                                          • Opcode Fuzzy Hash: a5f41a95b234689400651ffc7a7e648ad6c8ae29c578f3c4a4f7439c6b153684
                                                                                          • Instruction Fuzzy Hash: 99C123B2A002018BCB15CF69EC84356BFE4EB89311F1882BFE514AB3D5D7B89941C7D8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004B60E8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165windowCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 75%
                                                                                          			E004B60E8(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t26;
				intOrPtr _t31;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t61;
				WCHAR* _t63;
				intOrPtr _t69;
				intOrPtr _t74;
				int _t75;
				intOrPtr _t76;
				intOrPtr _t78;
				struct HWND__* _t81;
				intOrPtr _t82;
				intOrPtr _t86;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t120;
				intOrPtr _t121;

				_t119 = __esi;
				_t118 = __edi;
				_t85 = __ebx;
				_pop(_t101);
				_pop(_t88);
				 *[fs:eax] = _t101;
				E004AF678(_t88);
				if( *0x4ba440 == 0) {
					if(( *0x4c1d71 & 0x00000001) == 0 &&  *0x4ba441 == 0) {
						_t61 =  *0x4ba674; // 0x4c0d0c
						_t4 = _t61 + 0x2f8; // 0x230aa8c
						_t63 = E004084EC( *_t4);
						_t88 = _t120 - 0x28;
						_t101 =  *0x4c1c48; // 0x232f4ec
						E00426F08(0xc2, _t120 - 0x28, _t101);
						if(MessageBoxW(0, E004084EC( *((intOrPtr*)(_t120 - 0x28))), _t63, 0x24) != 6) {
							 *0x4ba44c = 2;
							E0041F238();
						}
					}
					E004056D0();
					E004AEFE8(_t120 - 0x2c, _t85, _t101, _t118, _t119); // executed
					E00407E00(0x4c1d94,  *((intOrPtr*)(_t120 - 0x2c)));
					_t26 =  *0x4c1d84; // 0x2302e7c
					E00422954(_t26, _t88, _t120 - 0x34);
					E004226C8( *((intOrPtr*)(_t120 - 0x34)), _t85, _t120 - 0x30, L".tmp", _t118, _t119);
					_push( *((intOrPtr*)(_t120 - 0x30)));
					_t31 =  *0x4c1d94; // 0x22a7f8c
					E00422660(_t31, _t120 - 0x38);
					_pop(_t90);
					E0040873C(0x4c1d98, _t90,  *((intOrPtr*)(_t120 - 0x38)));
					_t107 =  *0x4c1d98; // 0x22c4c4c
					E00407E00(0x4c1d9c, _t107);
					_t37 =  *0x4c1d90; // 0x4e0234
					_t15 = _t37 + 0x14; // 0x279280
					_t38 =  *0x4c1d88; // 0x0
					E00423CE8(_t38,  *_t15);
					_push(_t120);
					_push(0x4b63ab);
					_push( *[fs:edx]);
					 *[fs:edx] = _t121;
					 *0x4c1de0 = 0;
					_t42 = E00423D00(1, 0, 1, 0); // executed
					 *0x4c1d8c = _t42;
					_push(_t120);
					_push(0x4b639a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t44 =  *0x4c1d90; // 0x4e0234
					_t16 = _t44 + 0x18; // 0x30d600
					 *0x4c1de0 = E004053F0( *_t16);
					_t47 =  *0x4c1d90; // 0x4e0234
					_t17 = _t47 + 0x18; // 0x30d600
					_t86 =  *0x4c1de0; // 0x7fba0010
					E00405884(_t86,  *_t17);
					_push(_t120);
					_push(0x4b62e9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t51 =  *0x424cd8; // 0x424d30
					_t93 =  *0x4c1d88; // 0x0
					_t53 = E00424748(_t93, 1, _t51); // executed
					 *0x4c1de4 = _t53;
					_push(_t120);
					_push(0x4b62d8);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t55 =  *0x4c1d90; // 0x4e0234
					_t18 = _t55 + 0x18; // 0x30d600
					_t56 =  *0x4c1de4; // 0x225ecd0
					E00424A24(_t56,  *_t18, _t86);
					_pop(_t114);
					 *[fs:eax] = _t114;
					_push(E004B62DF);
					_t59 =  *0x4c1de4; // 0x225ecd0
					return E00405CE8(_t59);
				} else {
					_t69 =  *0x4ba674; // 0x4c0d0c
					_t1 = _t69 + 0x1d0; // 0x0
					E004AFA44( *_t1, __ebx, __edi, __esi);
					 *0x4ba44c = 0;
					_pop(_t115);
					 *[fs:eax] = _t115;
					_push(E004B6554);
					_t74 =  *0x4c1d88; // 0x0
					_t75 = E00405CE8(_t74);
					if( *0x4c1d9c != 0) {
						_t117 =  *0x4c1d9c; // 0x22c4c4c
						_t75 = E004AF1B4(0, _t117, 0xfa, 0x32);
					}
					if( *0x4c1d94 != 0) {
						_t82 =  *0x4c1d94; // 0x22a7f8c
						_t75 = RemoveDirectoryW(E004084EC(_t82));
					}
					if( *0x4ba450 != 0) {
						_t81 =  *0x4ba450; // 0x140394
						_t75 = DestroyWindow(_t81);
					}
					if( *0x4c1d78 != 0) {
						_t76 =  *0x4c1d78; // 0x2336888
						_t99 =  *0x4c1d7c; // 0x1
						_t116 =  *0x426bb0; // 0x426bb4
						E00408D08(_t76, _t99, _t116);
						_t78 =  *0x4c1d78; // 0x2336888
						E0040540C(_t78);
						 *0x4c1d78 = 0;
						return 0;
					}
					return _t75;
				}
			}




































                                                                                          0x004b60e8
                                                                                          0x004b60e8
                                                                                          0x004b60e8
                                                                                          0x004b60ea
                                                                                          0x004b60ec
                                                                                          0x004b60ed
                                                                                          0x004b610d
                                                                                          0x004b6119
                                                                                          0x004b613e
                                                                                          0x004b614b
                                                                                          0x004b6150
                                                                                          0x004b6156
                                                                                          0x004b615c
                                                                                          0x004b615f
                                                                                          0x004b6169
                                                                                          0x004b6181
                                                                                          0x004b6183
                                                                                          0x004b618d
                                                                                          0x004b618d
                                                                                          0x004b6181
                                                                                          0x004b6192
                                                                                          0x004b619a
                                                                                          0x004b61a7
                                                                                          0x004b61af
                                                                                          0x004b61b4
                                                                                          0x004b61c4
                                                                                          0x004b61cc
                                                                                          0x004b61d0
                                                                                          0x004b61d5
                                                                                          0x004b61e2
                                                                                          0x004b61e3
                                                                                          0x004b61ed
                                                                                          0x004b61f3
                                                                                          0x004b61f8
                                                                                          0x004b61fd
                                                                                          0x004b6200
                                                                                          0x004b6205
                                                                                          0x004b620c
                                                                                          0x004b620d
                                                                                          0x004b6212
                                                                                          0x004b6215
                                                                                          0x004b621a
                                                                                          0x004b6232
                                                                                          0x004b6237
                                                                                          0x004b623e
                                                                                          0x004b623f
                                                                                          0x004b6244
                                                                                          0x004b6247
                                                                                          0x004b624a
                                                                                          0x004b624f
                                                                                          0x004b6257
                                                                                          0x004b625c
                                                                                          0x004b6261
                                                                                          0x004b6264
                                                                                          0x004b626e
                                                                                          0x004b6275
                                                                                          0x004b6276
                                                                                          0x004b627b
                                                                                          0x004b627e
                                                                                          0x004b6281
                                                                                          0x004b6287
                                                                                          0x004b6294
                                                                                          0x004b6299
                                                                                          0x004b62a0
                                                                                          0x004b62a1
                                                                                          0x004b62a6
                                                                                          0x004b62a9
                                                                                          0x004b62ac
                                                                                          0x004b62b1
                                                                                          0x004b62b6
                                                                                          0x004b62bb
                                                                                          0x004b62c2
                                                                                          0x004b62c5
                                                                                          0x004b62c8
                                                                                          0x004b62cd
                                                                                          0x004b62d7
                                                                                          0x004b611b
                                                                                          0x004b611b
                                                                                          0x004b6120
                                                                                          0x004b6126
                                                                                          0x004b612d
                                                                                          0x004b64b5
                                                                                          0x004b64b8
                                                                                          0x004b64bb
                                                                                          0x004b64c0
                                                                                          0x004b64c5
                                                                                          0x004b64d1
                                                                                          0x004b64df
                                                                                          0x004b64e7
                                                                                          0x004b64e7
                                                                                          0x004b64f3
                                                                                          0x004b64f5
                                                                                          0x004b6500
                                                                                          0x004b6500
                                                                                          0x004b650c
                                                                                          0x004b650e
                                                                                          0x004b6514
                                                                                          0x004b6514
                                                                                          0x004b6520
                                                                                          0x004b6522
                                                                                          0x004b6527
                                                                                          0x004b652d
                                                                                          0x004b6533
                                                                                          0x004b6538
                                                                                          0x004b653d
                                                                                          0x004b6544
                                                                                          0x00000000
                                                                                          0x004b6544
                                                                                          0x004b6549
                                                                                          0x004b6549

                                                                                          APIs
                                                                                          • MessageBoxW.USER32(00000000,00000000,00000000,00000024), ref: 004B6179
                                                                                            • Part of subcall function 004AFA44: MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004AFAAE
                                                                                          • RemoveDirectoryW.KERNEL32(00000000,004B6554), ref: 004B6500
                                                                                          • DestroyWindow.USER32(00140394,004B6554), ref: 004B6514
                                                                                            • Part of subcall function 004AF1B4: Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1D3
                                                                                            • Part of subcall function 004AF1B4: GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1F6
                                                                                            • Part of subcall function 004AF1B4: GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF200
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastMessage$DestroyDirectoryRemoveSleepWindow
                                                                                          • String ID: .tmp$0MB
                                                                                          • API String ID: 3858953238-176122739
                                                                                          • Opcode ID: 930ec171da33bb7cb26a68baf49ed61eca7e6ecce176de484762bd5e64518e8e
                                                                                          • Instruction ID: b159488041d1577a8b45ed1a1d18f26c00613076fc9a683522f38ff229f2206a
                                                                                          • Opcode Fuzzy Hash: 930ec171da33bb7cb26a68baf49ed61eca7e6ecce176de484762bd5e64518e8e
                                                                                          • Instruction Fuzzy Hash: AC615A342002009FD755EF69ED86EAA37A5EB4A308F51453AF801976B2DA3CBC51CB6D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004B5000 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 79%
                                                                                          			E004B5000(void* __ecx, void* __edx) {
				intOrPtr _t19;
				intOrPtr _t22;

				_push(_t22);
				_push(0x4b50d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t22;
				 *0x4bb98c =  *0x4bb98c - 1;
				if( *0x4bb98c < 0) {
					E00405B74();
					E004051A8();
					SetThreadLocale(0x400); // executed
					E0040A250();
					 *0x4b700c = 2;
					 *0x4bb01c = 0x4036b0;
					 *0x4bb020 = 0x4036b8;
					 *0x4bb05a = 2;
					 *0x4bb060 = E0040CAA4();
					 *0x4bb008 = 0x4095a0;
					E00405BCC(E00405BB0());
					 *0x4bb068 = 0xd7b0;
					 *0x4bb344 = 0xd7b0;
					 *0x4bb620 = 0xd7b0;
					 *0x4bb050 = GetCommandLineW();
					 *0x4bb04c = E00403810();
					 *0x4bb97c = GetACP();
					 *0x4bb980 = 0x4b0;
					 *0x4bb044 = GetCurrentThreadId();
					E0040CAB8();
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(0x4b50de);
				return 0;
			}





                                                                                          0x004b5005
                                                                                          0x004b5006
                                                                                          0x004b500b
                                                                                          0x004b500e
                                                                                          0x004b5011
                                                                                          0x004b5018
                                                                                          0x004b501e
                                                                                          0x004b5023
                                                                                          0x004b502d
                                                                                          0x004b5032
                                                                                          0x004b5037
                                                                                          0x004b503e
                                                                                          0x004b5048
                                                                                          0x004b5052
                                                                                          0x004b505e
                                                                                          0x004b5063
                                                                                          0x004b5072
                                                                                          0x004b5077
                                                                                          0x004b5080
                                                                                          0x004b5089
                                                                                          0x004b5097
                                                                                          0x004b50a1
                                                                                          0x004b50ab
                                                                                          0x004b50b0
                                                                                          0x004b50bf
                                                                                          0x004b50c4
                                                                                          0x004b50c4
                                                                                          0x004b50cb
                                                                                          0x004b50ce
                                                                                          0x004b50d1
                                                                                          0x004b50d6

                                                                                          APIs
                                                                                          • SetThreadLocale.KERNEL32(00000400,00000000,004B50D7), ref: 004B502D
                                                                                            • Part of subcall function 0040A250: InitializeCriticalSection.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A255
                                                                                            • Part of subcall function 0040A250: GetVersion.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A263
                                                                                            • Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A28A
                                                                                            • Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A290
                                                                                            • Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2A4
                                                                                            • Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2AA
                                                                                            • Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2BE
                                                                                            • Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2C4
                                                                                            • Part of subcall function 0040CAA4: GetSystemInfo.KERNEL32 ref: 0040CAA8
                                                                                          • GetCommandLineW.KERNEL32(00000400,00000000,004B50D7), ref: 004B5092
                                                                                            • Part of subcall function 00403810: GetStartupInfoW.KERNEL32 ref: 00403821
                                                                                          • GetACP.KERNEL32(00000400,00000000,004B50D7), ref: 004B50A6
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004B50BA
                                                                                            • Part of subcall function 0040CAB8: GetVersion.KERNEL32(004B50C9,00000400,00000000,004B50D7), ref: 0040CAB8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
                                                                                          • String ID:
                                                                                          • API String ID: 2740004594-0
                                                                                          • Opcode ID: aeeb1ef19c021384e5e919f33d2f1f63d534ea4b25bb20b8f726cabb6b9d9f22
                                                                                          • Instruction ID: 4c04e7183c3d5c6504f231a905193e891933426fc174ea8e71756e1f90614aff
                                                                                          • Opcode Fuzzy Hash: aeeb1ef19c021384e5e919f33d2f1f63d534ea4b25bb20b8f726cabb6b9d9f22
                                                                                          • Instruction Fuzzy Hash: 46111CB04047449FE311BF76A8062267BA8EB05309B508A7FE110662E2EBFD15048FEE
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AEFE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 73%
                                                                                          			E004AEFE8(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char* _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				int _t30;
				intOrPtr _t63;
				void* _t71;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;

				_t71 = __edi;
				_t54 = __ebx;
				_t75 = _t76;
				_t55 = 4;
				do {
					_push(0);
					_push(0);
					_t55 = _t55 - 1;
				} while (_t55 != 0);
				_push(_t55);
				_push(__ebx);
				_t73 = __eax;
				_t78 = 0;
				_push(_t75);
				_push(0x4af0e1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				while(1) {
					E00422D70( &_v12, _t54, _t55, _t78); // executed
					_t55 = L".tmp";
					E004AEEC8(0, _t54, L".tmp", _v12, _t71, _t73,  &_v8); // executed
					_t30 = CreateDirectoryW(E004084EC(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t54 = GetLastError();
					_t78 = _t54 - 0xb7;
					if(_t54 != 0xb7) {
						E00426F08(0x3d,  &_v32, _v8);
						_v28 = _v32;
						E00419E18( &_v36, _t54, 0);
						_v24 = _v36;
						E004232EC(_t54,  &_v40);
						_v20 = _v40;
						E00426ED8(0x81, 2,  &_v28,  &_v16);
						_t55 = _v16;
						E0041F264(_v16, 1);
						E0040711C();
					}
				}
				E00407E00(_t73, _v8);
				__eflags = 0;
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E004AF0E8);
				E00407A80( &_v40, 3);
				return E00407A80( &_v16, 3);
			}


















                                                                                          0x004aefe8
                                                                                          0x004aefe8
                                                                                          0x004aefe9
                                                                                          0x004aefeb
                                                                                          0x004aeff0
                                                                                          0x004aeff0
                                                                                          0x004aeff2
                                                                                          0x004aeff4
                                                                                          0x004aeff4
                                                                                          0x004aeff7
                                                                                          0x004aeff8
                                                                                          0x004aeffa
                                                                                          0x004aeffc
                                                                                          0x004aeffe
                                                                                          0x004aefff
                                                                                          0x004af004
                                                                                          0x004af007
                                                                                          0x004af00a
                                                                                          0x004af011
                                                                                          0x004af019
                                                                                          0x004af020
                                                                                          0x004af030
                                                                                          0x004af037
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af03e
                                                                                          0x004af040
                                                                                          0x004af046
                                                                                          0x004af056
                                                                                          0x004af05e
                                                                                          0x004af06a
                                                                                          0x004af072
                                                                                          0x004af07a
                                                                                          0x004af082
                                                                                          0x004af091
                                                                                          0x004af096
                                                                                          0x004af0a0
                                                                                          0x004af0a5
                                                                                          0x004af0a5
                                                                                          0x004af046
                                                                                          0x004af0b4
                                                                                          0x004af0b9
                                                                                          0x004af0bb
                                                                                          0x004af0be
                                                                                          0x004af0c1
                                                                                          0x004af0ce
                                                                                          0x004af0e0

                                                                                          APIs
                                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,004AF0E1,?,?,?,00000003,00000000,00000000,?,004B619F), ref: 004AF030
                                                                                          • GetLastError.KERNEL32(00000000,00000000,?,00000000,004AF0E1,?,?,?,00000003,00000000,00000000,?,004B619F), ref: 004AF039
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: .tmp
                                                                                          • API String ID: 1375471231-2986845003
                                                                                          • Opcode ID: b866ae3ac5566b90e4d091c6d0119bd5c5d6e6cd69059738e462e2ab807557f0
                                                                                          • Instruction ID: 89b964d67460c442e7c67535b057b8112791baa86db9a38931a927ffd746d2a8
                                                                                          • Opcode Fuzzy Hash: b866ae3ac5566b90e4d091c6d0119bd5c5d6e6cd69059738e462e2ab807557f0
                                                                                          • Instruction Fuzzy Hash: 3A218735A041089BDB00EBE1C842ADFB3B9EB49304F50447BF800F7381DA386E058BA9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 451 40e450-40e4a4 call 405740 CreateWindowExW call 405730
                                                                                          C-Code - Quality: 100%
                                                                                          			E0040E450(long __eax, WCHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				WCHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				WCHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00405740();
				_t24 = CreateWindowExW(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00405730(_t13);
				return _t24;
			}








                                                                                          0x0040e457
                                                                                          0x0040e45c
                                                                                          0x0040e45e
                                                                                          0x0040e48f
                                                                                          0x0040e498
                                                                                          0x0040e4a4

                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID: InnoSetupLdrWindow$STATIC
                                                                                          • API String ID: 716092398-2209255943
                                                                                          • Opcode ID: 4ba199ab3c1e041c72a50ebd66c3ee798d5f8225e8fee486b5eb3d70e3749009
                                                                                          • Instruction ID: 770f17d29583ffea265d4876c6cd55b491c436ce5e2cc0b006eebdc9bc405b2a
                                                                                          • Opcode Fuzzy Hash: 4ba199ab3c1e041c72a50ebd66c3ee798d5f8225e8fee486b5eb3d70e3749009
                                                                                          • Instruction Fuzzy Hash: 73F07FB6600118AF9B84DE9EDC85E9B77ECEB4D264B05412ABA08E7201D634ED118BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041FF94 Relevance: 4.6, APIs: 3, Instructions: 93COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 63%
                                                                                          			E0041FF94(void* __eax, void* __ebx, signed int* __ecx, signed int* __edx, void* __edi, void* __esi, signed int* _a4) {
				char _v8;
				char _v9;
				int _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _t33;
				int _t43;
				int _t64;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int* _t77;
				signed int* _t79;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t81 = _t82;
				_t83 = _t82 + 0xffffffe8;
				_v8 = 0;
				_t77 = __ecx;
				_t79 = __edx;
				_push(_t81);
				_push(0x420094);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_v9 = 0;
				E00407E48( &_v8, __eax);
				E00407FB0( &_v8);
				_t33 = GetFileVersionInfoSizeW(E004084EC(_v8),  &_v16); // executed
				_t64 = _t33;
				if(_t64 == 0) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(0x42009b);
					return E00407A20( &_v8);
				} else {
					_v20 = E004053F0(_t64);
					_push(_t81);
					_push(0x420077);
					_push( *[fs:edx]);
					 *[fs:edx] = _t83;
					_t43 = GetFileVersionInfoW(E004084EC(_v8), _v16, _t64, _v20); // executed
					if(_t43 != 0 && VerQueryValueW(_v20, 0x4200a8,  &_v24,  &_v28) != 0) {
						 *_t79 =  *(_v24 + 0x10) >> 0x00000010 & 0x0000ffff;
						 *_t77 =  *(_v24 + 0x10) & 0x0000ffff;
						 *_a4 =  *(_v24 + 0x14) >> 0x00000010 & 0x0000ffff;
						_v9 = 1;
					}
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(0x42007e);
					return E0040540C(_v20);
				}
			}



















                                                                                          0x0041ff95
                                                                                          0x0041ff97
                                                                                          0x0041ff9f
                                                                                          0x0041ffa2
                                                                                          0x0041ffa4
                                                                                          0x0041ffaa
                                                                                          0x0041ffab
                                                                                          0x0041ffb0
                                                                                          0x0041ffb3
                                                                                          0x0041ffb6
                                                                                          0x0041ffbf
                                                                                          0x0041ffc7
                                                                                          0x0041ffd9
                                                                                          0x0041ffde
                                                                                          0x0041ffe2
                                                                                          0x00420080
                                                                                          0x00420083
                                                                                          0x00420086
                                                                                          0x00420093
                                                                                          0x0041ffe8
                                                                                          0x0041ffef
                                                                                          0x0041fff4
                                                                                          0x0041fff5
                                                                                          0x0041fffa
                                                                                          0x0041fffd
                                                                                          0x00420012
                                                                                          0x00420019
                                                                                          0x00420041
                                                                                          0x0042004a
                                                                                          0x0042005b
                                                                                          0x0042005d
                                                                                          0x0042005d
                                                                                          0x00420063
                                                                                          0x00420066
                                                                                          0x00420069
                                                                                          0x00420076
                                                                                          0x00420076

                                                                                          APIs
                                                                                          • GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00420094), ref: 0041FFD9
                                                                                          • GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00420077,?,00000000,?,00000000,00420094), ref: 00420012
                                                                                          • VerQueryValueW.VERSION(?,004200A8,?,?,00000000,?,00000000,?,00000000,00420077,?,00000000,?,00000000,00420094), ref: 0042002C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileInfoVersion$QuerySizeValue
                                                                                          • String ID:
                                                                                          • API String ID: 2179348866-0
                                                                                          • Opcode ID: db1b7188df03ba7b3b32e0e3197f16d1bbb1710ebdecda22b0e2c2fca2e7d661
                                                                                          • Instruction ID: 087fa93cc02b824bee97242c1a4c1e6fbe52d07f241be95d6751b2a9bfa32856
                                                                                          • Opcode Fuzzy Hash: db1b7188df03ba7b3b32e0e3197f16d1bbb1710ebdecda22b0e2c2fca2e7d661
                                                                                          • Instruction Fuzzy Hash: 19314771A042199FD710DFA9D941DAFB7F8EB48700B91447AF944E3252D778DD00C765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040B110 Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 476 40b110-40b152 call 407b04 * 2 call 407a20 483 40b158-40b168 call 407e48 476->483 484 40b20c-40b226 call 407a80 476->484 489 40b16a-40b16d 483->489 490 40b16f-40b174 483->490 489->490 492 40b176-40b17f 490->492 493 40b19b-40b1aa call 40ae34 490->493 494 40b181-40b194 call 4088ac 492->494 495 40b196-40b199 492->495 500 40b1bb-40b1d8 GetUserDefaultUILanguage call 40a7e4 call 40af60 493->500 501 40b1ac-40b1b9 call 40af60 493->501 494->493 495->492 495->493 508 40b1da-40b1e1 500->508 509 40b1fd-40b200 500->509 501->484 508->509 510 40b1e3-40b1f8 GetSystemDefaultUILanguage call 40a7e4 call 40af60 508->510 509->484 511 40b202-40b207 call 40b044 509->511 510->509 511->484
                                                                                          C-Code - Quality: 72%
                                                                                          			E0040B110(intOrPtr __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t41;
				signed short _t43;
				signed short _t46;
				signed int _t60;
				intOrPtr _t68;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_t61 = __ecx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				E00407B04(_v12);
				_push(_t84);
				_push(0x40b227);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E00407A20(__ecx);
				if(_v12 == 0) {
					L14:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(E0040B22E);
					return E00407A80( &_v28, 6);
				}
				E00407E48( &_v20, _v12);
				_t41 = _v12;
				if(_t41 != 0) {
					_t41 =  *(_t41 - 4);
				}
				_t60 = _t41;
				if(_t60 < 1) {
					L7:
					_t43 = E0040AE34(_v8, _t60, _t61,  &_v16, _t81); // executed
					if(_v16 == 0) {
						L00403730();
						E0040A7E4(_t43, _t60,  &_v24, _t79, _t81);
						_t46 = E0040AF60(_v20, _t60, _t81, _v24, _t79, _t81); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x4bdc0c;
							if( *0x4bdc0c == 0) {
								L00403738();
								E0040A7E4(_t46, _t60,  &_v28, _t79, _t81);
								E0040AF60(_v20, _t60, _t81, _v28, _t79, _t81);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E0040B044(_v20, _t60, _t81, __eflags); // executed
						}
					} else {
						E0040AF60(_v20, _t60, _t81, _v16, _t79, _t81);
					}
					goto L14;
				}
				while( *((short*)(_v12 + _t60 * 2 - 2)) != 0x2e) {
					_t60 = _t60 - 1;
					__eflags = _t60;
					if(_t60 != 0) {
						continue;
					}
					goto L7;
				}
				_t61 = _t60;
				E004088AC(_v12, _t60, 1,  &_v20);
				goto L7;
			}

















                                                                                          0x0040b110
                                                                                          0x0040b110
                                                                                          0x0040b113
                                                                                          0x0040b115
                                                                                          0x0040b117
                                                                                          0x0040b119
                                                                                          0x0040b11b
                                                                                          0x0040b11d
                                                                                          0x0040b11f
                                                                                          0x0040b120
                                                                                          0x0040b121
                                                                                          0x0040b123
                                                                                          0x0040b126
                                                                                          0x0040b12c
                                                                                          0x0040b134
                                                                                          0x0040b13b
                                                                                          0x0040b13c
                                                                                          0x0040b141
                                                                                          0x0040b144
                                                                                          0x0040b149
                                                                                          0x0040b152
                                                                                          0x0040b20c
                                                                                          0x0040b20e
                                                                                          0x0040b211
                                                                                          0x0040b214
                                                                                          0x0040b226
                                                                                          0x0040b226
                                                                                          0x0040b15e
                                                                                          0x0040b163
                                                                                          0x0040b168
                                                                                          0x0040b16d
                                                                                          0x0040b16d
                                                                                          0x0040b16f
                                                                                          0x0040b174
                                                                                          0x0040b19b
                                                                                          0x0040b1a1
                                                                                          0x0040b1aa
                                                                                          0x0040b1bb
                                                                                          0x0040b1c3
                                                                                          0x0040b1d0
                                                                                          0x0040b1d5
                                                                                          0x0040b1d8
                                                                                          0x0040b1da
                                                                                          0x0040b1e1
                                                                                          0x0040b1e3
                                                                                          0x0040b1eb
                                                                                          0x0040b1f8
                                                                                          0x0040b1f8
                                                                                          0x0040b1e1
                                                                                          0x0040b1fd
                                                                                          0x0040b200
                                                                                          0x0040b207
                                                                                          0x0040b207
                                                                                          0x0040b1ac
                                                                                          0x0040b1b4
                                                                                          0x0040b1b4
                                                                                          0x00000000
                                                                                          0x0040b1aa
                                                                                          0x0040b176
                                                                                          0x0040b196
                                                                                          0x0040b197
                                                                                          0x0040b199
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040b199
                                                                                          0x0040b185
                                                                                          0x0040b18f
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetUserDefaultUILanguage.KERNEL32(00000000,0040B227,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B2AE,00000000,?,00000105), ref: 0040B1BB
                                                                                          • GetSystemDefaultUILanguage.KERNEL32(00000000,0040B227,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B2AE,00000000,?,00000105), ref: 0040B1E3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DefaultLanguage$SystemUser
                                                                                          • String ID:
                                                                                          • API String ID: 384301227-0
                                                                                          • Opcode ID: 8091743a5a45bbad2069f173d476493d8776fa257b9783c2651a700d4e0e0a8f
                                                                                          • Instruction ID: e5bcb09f7540d0846d638ab8db7cc306f2a88a3609992180fc1e837192b0f5a6
                                                                                          • Opcode Fuzzy Hash: 8091743a5a45bbad2069f173d476493d8776fa257b9783c2651a700d4e0e0a8f
                                                                                          • Instruction Fuzzy Hash: B0313070A142499BDB10EBA5C891AAEB7B5EF48304F50857BE400B73D1DB7CAD41CB9E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040B234 Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E0040B234(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x40b2ee);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E00408550( &_v536, _t49);
				_push(_v536);
				E0040858C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E0040B110(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E004084EC(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0040B2F5);
				E00407A80( &_v540, 2);
				return E00407A20( &_v8);
			}











                                                                                          0x0040b241
                                                                                          0x0040b247
                                                                                          0x0040b24d
                                                                                          0x0040b250
                                                                                          0x0040b254
                                                                                          0x0040b255
                                                                                          0x0040b25a
                                                                                          0x0040b25d
                                                                                          0x0040b270
                                                                                          0x0040b27d
                                                                                          0x0040b288
                                                                                          0x0040b29a
                                                                                          0x0040b2a8
                                                                                          0x0040b2a9
                                                                                          0x0040b2b2
                                                                                          0x0040b2c1
                                                                                          0x0040b2c6
                                                                                          0x0040b2ca
                                                                                          0x0040b2cd
                                                                                          0x0040b2d0
                                                                                          0x0040b2e0
                                                                                          0x0040b2ed

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B2EE,?,00400000,004B7C20), ref: 0040B270
                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B2EE,?,00400000,004B7C20), ref: 0040B2C1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileLibraryLoadModuleName
                                                                                          • String ID:
                                                                                          • API String ID: 1159719554-0
                                                                                          • Opcode ID: c89eb0a175d0b8486c29a163bc28afc1dff8206c8c77fc3926f93841ada109dc
                                                                                          • Instruction ID: c66d7809fa1512833e1e01641763b0ecb7dd00f0751393a0e64d94d028879d96
                                                                                          • Opcode Fuzzy Hash: c89eb0a175d0b8486c29a163bc28afc1dff8206c8c77fc3926f93841ada109dc
                                                                                          • Instruction Fuzzy Hash: 35116070A4421CABDB10EB55CD86BDE77B8DB04304F5144BEE508B32C1DA785F848AA9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00421230 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 37%
                                                                                          			E00421230(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x4212a2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x421284);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E004084EC(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(0x42128b);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}












                                                                                          0x00421231
                                                                                          0x00421233
                                                                                          0x00421237
                                                                                          0x0042123a
                                                                                          0x0042123f
                                                                                          0x00421244
                                                                                          0x00421245
                                                                                          0x0042124a
                                                                                          0x0042124d
                                                                                          0x00421250
                                                                                          0x00421255
                                                                                          0x00421256
                                                                                          0x0042125b
                                                                                          0x0042125e
                                                                                          0x00421269
                                                                                          0x0042126e
                                                                                          0x00421273
                                                                                          0x00421276
                                                                                          0x00421279
                                                                                          0x0042127e
                                                                                          0x00421280
                                                                                          0x00421283

                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32 ref: 0042123A
                                                                                          • LoadLibraryW.KERNEL32(00000000,00000000,00421284,?,00000000,004212A2), ref: 00421269
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLibraryLoadMode
                                                                                          • String ID:
                                                                                          • API String ID: 2987862817-0
                                                                                          • Opcode ID: 5d62b3fe4766baadd73c675683546c7f58e01c4ce11fe1a914dda1a55ed8f36c
                                                                                          • Instruction ID: 4174928c950a8c4d8a753a2a73b5e5f46ee32f9a8ef6f103d2b3a03bcfaff51e
                                                                                          • Opcode Fuzzy Hash: 5d62b3fe4766baadd73c675683546c7f58e01c4ce11fe1a914dda1a55ed8f36c
                                                                                          • Instruction Fuzzy Hash: 15F08270A14744BFDB115F779C5282BBAACE709B047A348BAF800F2691E53C48208574
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004232EC Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004232EC(long __eax, void* __edx) {
				short _v2052;
				signed int _t7;
				void* _t10;
				signed int _t16;
				void* _t17;

				_t10 = __edx;
				_t7 = FormatMessageW(0x3200, 0, __eax, 0,  &_v2052, 0x400, 0); // executed
				while(_t7 > 0) {
					_t16 =  *(_t17 + _t7 * 2 - 2) & 0x0000ffff;
					if(_t16 <= 0x20) {
						L1:
						_t7 = _t7 - 1;
						__eflags = _t7;
						continue;
					} else {
						_t20 = _t16 - 0x2e;
						if(_t16 == 0x2e) {
							goto L1;
						}
					}
					break;
				}
				return E00407BA8(_t10, _t7, _t17, _t20);
			}








                                                                                          0x004232f3
                                                                                          0x0042330b
                                                                                          0x00423313
                                                                                          0x00423317
                                                                                          0x00423320
                                                                                          0x00423312
                                                                                          0x00423312
                                                                                          0x00423312
                                                                                          0x00000000
                                                                                          0x00423322
                                                                                          0x00423322
                                                                                          0x00423326
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00423326
                                                                                          0x00000000
                                                                                          0x00423320
                                                                                          0x00423339

                                                                                          APIs
                                                                                          • FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,00423C1E,00000000,00423C6F,?,00423E28), ref: 0042330B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FormatMessage
                                                                                          • String ID:
                                                                                          • API String ID: 1306739567-0
                                                                                          • Opcode ID: 8c28d4cd2feba8420b72e2c8323dac74420019247290cbce7f55a68a80108edc
                                                                                          • Instruction ID: 75fedbff241bec6efc8727d26b236f8c34027f11b3bdd8370f626a5f6d270aaf
                                                                                          • Opcode Fuzzy Hash: 8c28d4cd2feba8420b72e2c8323dac74420019247290cbce7f55a68a80108edc
                                                                                          • Instruction Fuzzy Hash: 89E0D86075432121F624A9052C03B7B2129A7C0B12FE084367A80DE3D5DEADAF55525E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00422A18 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 31%
                                                                                          			E00422A18(void* __eax, void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t24;

				_push(0);
				_push(_t24);
				_push(0x422a5e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t24;
				E004229AC(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesW(E004084EC(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E00422A65);
				return E00407A20( &_v8);
			}






                                                                                          0x00422a1b
                                                                                          0x00422a22
                                                                                          0x00422a23
                                                                                          0x00422a28
                                                                                          0x00422a2b
                                                                                          0x00422a33
                                                                                          0x00422a41
                                                                                          0x00422a4a
                                                                                          0x00422a4d
                                                                                          0x00422a50
                                                                                          0x00422a5d

                                                                                          APIs
                                                                                          • GetFileAttributesW.KERNEL32(00000000,00000000,00422A5E,?,?,00000000,?,00422A71,00422DE2,00000000,00422E27,?,?,00000000,00000000), ref: 00422A41
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 8cd9a521966ca01502d57987e2d96a70fbf8ec2bcb71e07358b87aea606a80f7
                                                                                          • Instruction ID: ce0c41168f735205187e46b6c3e9294348714fcf51f30dd0002a5427be662740
                                                                                          • Opcode Fuzzy Hash: 8cd9a521966ca01502d57987e2d96a70fbf8ec2bcb71e07358b87aea606a80f7
                                                                                          • Instruction Fuzzy Hash: D7E09231704308BBD721EB76DE9291AB7ECD788700BA14876B500E7682E6B86E108418
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00423DA8 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00423DA8(signed int __ecx, void* __edx, signed char _a4, signed char _a8) {
				void* _t17;

				_t17 = CreateFileW(E004084EC(__edx),  *(0x4b92e0 + (_a8 & 0x000000ff) * 4),  *(0x4b92ec + (_a4 & 0x000000ff) * 4), 0,  *(0x4b92fc + (__ecx & 0x000000ff) * 4), 0x80, 0); // executed
				return _t17;
			}




                                                                                          0x00423de5
                                                                                          0x00423ded

                                                                                          APIs
                                                                                          • CreateFileW.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00423DE5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: dd9159e21b70a0e7bcb8d3c3b5b03a1c2ffc365921e6ade8a7c7864e99aae5ed
                                                                                          • Instruction ID: 37fe8146f2431012b4276926014d9d5fd10bf57e8855788e2bc853c5fce69268
                                                                                          • Opcode Fuzzy Hash: dd9159e21b70a0e7bcb8d3c3b5b03a1c2ffc365921e6ade8a7c7864e99aae5ed
                                                                                          • Instruction Fuzzy Hash: 81E048716441283FD6149ADE7C91F76779C9709754F404563F684D7281C4A59D1086FC
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00409FA8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00409FA8(void* __eax) {
				short _v532;
				void* __ebx;
				void* __esi;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t16 = __eax;
				_t22 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x400000
					GetModuleFileNameW( *_t3,  &_v532, 0x20a);
					_t14 = E0040B234(_t21, _t16, _t18, _t19, _t22); // executed
					_t20 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t20;
					if(_t20 == 0) {
						_t5 = _t16 + 4; // 0x400000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x400000
				return  *_t7;
			}












                                                                                          0x00409fb0
                                                                                          0x00409fb2
                                                                                          0x00409fb6
                                                                                          0x00409fc2
                                                                                          0x00409fc6
                                                                                          0x00409fcf
                                                                                          0x00409fd4
                                                                                          0x00409fd6
                                                                                          0x00409fdb
                                                                                          0x00409fdd
                                                                                          0x00409fe0
                                                                                          0x00409fe0
                                                                                          0x00409fdb
                                                                                          0x00409fe3
                                                                                          0x00409fee

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 00409FC6
                                                                                            • Part of subcall function 0040B234: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B2EE,?,00400000,004B7C20), ref: 0040B270
                                                                                            • Part of subcall function 0040B234: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B2EE,?,00400000,004B7C20), ref: 0040B2C1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleName$LibraryLoad
                                                                                          • String ID:
                                                                                          • API String ID: 4113206344-0
                                                                                          • Opcode ID: 2301add7ea149dd4fbebfdf59b7b3942b6e3d1df22e9777a155c308e994de31e
                                                                                          • Instruction ID: 1beb63cefa55d3dba2b36e2095187d50c135a0cf4330adb642bee8d6847d8901
                                                                                          • Opcode Fuzzy Hash: 2301add7ea149dd4fbebfdf59b7b3942b6e3d1df22e9777a155c308e994de31e
                                                                                          • Instruction Fuzzy Hash: 7BE0C971A013119BCB10DE58C8C5A4A3798AB08754F044AA6AD24DF387D3B5DD1487D5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00423ED8 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00423ED8(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E00423CAC( *_t7);
				}
				return _t4;
			}





                                                                                          0x00423ed9
                                                                                          0x00423edf
                                                                                          0x00423ee6
                                                                                          0x00000000
                                                                                          0x00423eea
                                                                                          0x00423ef0

                                                                                          APIs
                                                                                          • SetEndOfFile.KERNEL32(?,7FBA0010,004B6358,00000000), ref: 00423EDF
                                                                                            • Part of subcall function 00423CAC: GetLastError.KERNEL32(004237FC,00423D4F,?,?,02302E7C,?,004B5F76,00000001,00000000,00000002,00000000,004B659E,?,00000000,004B65E2), ref: 00423CAF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLast
                                                                                          • String ID:
                                                                                          • API String ID: 734332943-0
                                                                                          • Opcode ID: 09339d9670a81d77462708df034512c3e9d7a5ee9c38b49a5b5d33688a33920b
                                                                                          • Instruction ID: ae15968ab9cd064c61534cde2c099b4aac4a7b80231ae1acb8e6de6fcc6ca8bf
                                                                                          • Opcode Fuzzy Hash: 09339d9670a81d77462708df034512c3e9d7a5ee9c38b49a5b5d33688a33920b
                                                                                          • Instruction Fuzzy Hash: 58C04C61300210478B04EEBBD5C190666E85B582157414466B904DB216E67DD9158615
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040CAA4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0040CAA4() {
				intOrPtr _v16;
				struct _SYSTEM_INFO* _t3;

				GetSystemInfo(_t3); // executed
				return _v16;
			}





                                                                                          0x0040caa8
                                                                                          0x0040cab4

                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoSystem
                                                                                          • String ID:
                                                                                          • API String ID: 31276548-0
                                                                                          • Opcode ID: 9dd1f6b5bb1b0da35443b21aa4a452d0333aba70165927044b368234b0936b7a
                                                                                          • Instruction ID: 4f21eec972071caf62eebbeb90550a79e4d7a8082c8b53f17589c9beddeb5e45
                                                                                          • Opcode Fuzzy Hash: 9dd1f6b5bb1b0da35443b21aa4a452d0333aba70165927044b368234b0936b7a
                                                                                          • Instruction Fuzzy Hash: CDA012984088002AC404AB194C4340F39C819C1114FC40224745CB62C2E61D866403DB
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00403BCC Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00403BCC(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void** _t10;
				void* _t12;
				void* _t14;

				_t8 = __eax;
				E00403B60(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x4bbaf0 = 0;
					return 0;
				} else {
					_t10 =  *0x4bbadc; // 0x2230000
					_t14 = _t4;
					 *_t14 = 0x4bbad8;
					 *0x4bbadc = _t4;
					 *(_t14 + 4) = _t10;
					 *_t10 = _t4;
					_t12 = _t14 + 0x13fff0;
					 *((intOrPtr*)(_t12 - 4)) = 2;
					 *0x4bbaf0 = 0x13ffe0 - _t8;
					_t7 = _t12 - _t8;
					 *0x4bbaec = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}









                                                                                          0x00403bce
                                                                                          0x00403bd0
                                                                                          0x00403be3
                                                                                          0x00403bea
                                                                                          0x00403c3c
                                                                                          0x00403c45
                                                                                          0x00403bec
                                                                                          0x00403bec
                                                                                          0x00403bf2
                                                                                          0x00403bf4
                                                                                          0x00403bfa
                                                                                          0x00403bff
                                                                                          0x00403c02
                                                                                          0x00403c06
                                                                                          0x00403c11
                                                                                          0x00403c1e
                                                                                          0x00403c26
                                                                                          0x00403c28
                                                                                          0x00403c35
                                                                                          0x00403c39
                                                                                          0x00403c39

                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,004041E3,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000), ref: 00403BE3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: cb8f292e3956ad7a1a5e0c92f19b435d8be5366ce3ed5ca5418bf36ecf0e0e1a
                                                                                          • Instruction ID: ee114c9f451a66722181258b66a673b4223530c98f306d9f720d31c7abdd50f3
                                                                                          • Opcode Fuzzy Hash: cb8f292e3956ad7a1a5e0c92f19b435d8be5366ce3ed5ca5418bf36ecf0e0e1a
                                                                                          • Instruction Fuzzy Hash: 71F087F2F002404FE7249F799D40742BAE8E709315B10827EE908EB799E7F488018B88
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00403CF6 Relevance: 1.3, APIs: 1, Instructions: 41COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 96%
                                                                                          			E00403CF6(void* __eax) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				void* _t13;
				int _t20;
				void* _t22;
				signed int _t26;
				signed int _t29;
				signed int _t30;
				void* _t34;
				intOrPtr _t35;
				signed int _t39;
				void* _t41;
				void* _t42;

				_push(_t29);
				_t42 = _t41 + 0xffffffdc;
				_t34 = __eax - 0x10;
				E00403C48();
				_t13 = _t34;
				 *_t42 =  *_t13;
				_v48 =  *((intOrPtr*)(_t13 + 4));
				_t26 =  *(_t13 + 0xc);
				if((_t26 & 0x00000008) != 0) {
					_t22 = _t34;
					_t39 = _t26 & 0xfffffff0;
					_t30 = 0;
					while(1) {
						VirtualQuery(_t22,  &_v44, 0x1c);
						if(VirtualFree(_t22, 0, 0x8000) == 0) {
							break;
						}
						_t35 = _v44.RegionSize;
						if(_t39 > _t35) {
							_t39 = _t39 - _t35;
							_t22 = _t22 + _t35;
							continue;
						}
						goto L10;
					}
					_t30 = _t30 | 0xffffffff;
				} else {
					_t20 = VirtualFree(_t34, 0, 0x8000); // executed
					if(_t20 == 0) {
						_t30 = _t29 | 0xffffffff;
					} else {
						_t30 = 0;
					}
				}
				L10:
				if(_t30 == 0) {
					 *_v48 =  *_t42;
					 *( *_t42 + 4) = _v48;
				}
				 *0x4bdb78 = 0;
				return _t30;
			}
















                                                                                          0x00403cfa
                                                                                          0x00403cfc
                                                                                          0x00403d01
                                                                                          0x00403d04
                                                                                          0x00403d09
                                                                                          0x00403d0d
                                                                                          0x00403d13
                                                                                          0x00403d17
                                                                                          0x00403d1d
                                                                                          0x00403d39
                                                                                          0x00403d3d
                                                                                          0x00403d40
                                                                                          0x00403d42
                                                                                          0x00403d4a
                                                                                          0x00403d5e
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00403d65
                                                                                          0x00403d6b
                                                                                          0x00403d6d
                                                                                          0x00403d6f
                                                                                          0x00000000
                                                                                          0x00403d6f
                                                                                          0x00000000
                                                                                          0x00403d6b
                                                                                          0x00403d60
                                                                                          0x00403d1f
                                                                                          0x00403d27
                                                                                          0x00403d2e
                                                                                          0x00403d34
                                                                                          0x00403d30
                                                                                          0x00403d30
                                                                                          0x00403d30
                                                                                          0x00403d2e
                                                                                          0x00403d73
                                                                                          0x00403d75
                                                                                          0x00403d7e
                                                                                          0x00403d87
                                                                                          0x00403d87
                                                                                          0x00403d8a
                                                                                          0x00403d9a

                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00403D27
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00403D4A
                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00403D57
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$Free$Query
                                                                                          • String ID:
                                                                                          • API String ID: 778034434-0
                                                                                          • Opcode ID: b86c7d193f0610a1d6d77379c4e955cbcb5794efed67ee39186848f082a0d71f
                                                                                          • Instruction ID: 6789628300bf7aa479fe1b8b627d7daf3441881ad106b622f2e79b23e4dc796b
                                                                                          • Opcode Fuzzy Hash: b86c7d193f0610a1d6d77379c4e955cbcb5794efed67ee39186848f082a0d71f
                                                                                          • Instruction Fuzzy Hash: C5F06D353046005FD311DF1AC844B17BBE9EFC5711F15C67AE888973A1E635DD018796
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Function 0040A928 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 78%
                                                                                          			E0040A928(short* __eax, intOrPtr __edx) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				void* _t55;
				signed int _t88;
				signed int _t89;
				intOrPtr* _t90;
				signed int _t101;
				signed int _t102;
				short* _t112;
				struct HINSTANCE__* _t113;
				short* _t115;
				short* _t116;
				void* _t117;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t113 = GetModuleHandleW(L"kernel32.dll");
				if(_t113 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t115 = _v8 + 4;
						goto L10;
					} else {
						if( *((short*)(_v8 + 2)) == 0x5c) {
							_t116 = E0040A904(_v8 + 4);
							if( *_t116 != 0) {
								_t14 = _t116 + 2; // 0x2
								_t115 = E0040A904(_t14);
								if( *_t115 != 0) {
									L10:
									_t88 = _t115 - _v8;
									_t89 = _t88 >> 1;
									if(_t88 < 0) {
										asm("adc ebx, 0x0");
									}
									_t43 = _t89 + 1;
									if(_t89 + 1 <= 0x105) {
										E0040A34C( &_v1134, _v8, _t43);
										while( *_t115 != 0) {
											_t112 = E0040A904(_t115 + 2);
											_t50 = _t112 - _t115;
											_t51 = _t50 >> 1;
											if(_t50 < 0) {
												asm("adc eax, 0x0");
											}
											if(_t51 + _t89 + 1 <= 0x105) {
												_t55 =  &_v1134 + _t89 + _t89;
												_t101 = _t112 - _t115;
												_t102 = _t101 >> 1;
												if(_t101 < 0) {
													asm("adc edx, 0x0");
												}
												E0040A34C(_t55, _t115, _t102 + 1);
												_v20 = FindFirstFileW( &_v1134,  &_v612);
												if(_v20 != 0xffffffff) {
													FindClose(_v20);
													if(lstrlenW( &(_v612.cFileName)) + _t89 + 1 + 1 <= 0x105) {
														 *((short*)(_t117 + _t89 * 2 - 0x46a)) = 0x5c;
														E0040A34C( &_v1134 + _t89 + _t89 + 2,  &(_v612.cFileName), 0x105 - _t89 - 1);
														_t89 = _t89 + lstrlenW( &(_v612.cFileName)) + 1;
														_t115 = _t112;
														continue;
													}
												}
											}
											goto L24;
										}
										E0040A34C(_v8,  &_v1134, _v12);
									}
								}
							}
						}
					}
				} else {
					_t90 = GetProcAddress(_t113, "GetLongPathNameW");
					if(_t90 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t90() == 0) {
							goto L4;
						} else {
							E0040A34C(_v8,  &_v1134, _v12);
						}
					}
				}
				L24:
				return _v16;
			}






















                                                                                          0x0040a934
                                                                                          0x0040a937
                                                                                          0x0040a93d
                                                                                          0x0040a94a
                                                                                          0x0040a94e
                                                                                          0x0040a98d
                                                                                          0x0040a994
                                                                                          0x0040a9d4
                                                                                          0x00000000
                                                                                          0x0040a996
                                                                                          0x0040a99e
                                                                                          0x0040a9af
                                                                                          0x0040a9b5
                                                                                          0x0040a9bb
                                                                                          0x0040a9c3
                                                                                          0x0040a9c9
                                                                                          0x0040a9d7
                                                                                          0x0040a9d9
                                                                                          0x0040a9dc
                                                                                          0x0040a9de
                                                                                          0x0040a9e0
                                                                                          0x0040a9e0
                                                                                          0x0040a9e3
                                                                                          0x0040a9eb
                                                                                          0x0040a9fc
                                                                                          0x0040aac3
                                                                                          0x0040aa0e
                                                                                          0x0040aa12
                                                                                          0x0040aa14
                                                                                          0x0040aa16
                                                                                          0x0040aa18
                                                                                          0x0040aa18
                                                                                          0x0040aa23
                                                                                          0x0040aa33
                                                                                          0x0040aa37
                                                                                          0x0040aa39
                                                                                          0x0040aa3b
                                                                                          0x0040aa3d
                                                                                          0x0040aa3d
                                                                                          0x0040aa43
                                                                                          0x0040aa5b
                                                                                          0x0040aa62
                                                                                          0x0040aa68
                                                                                          0x0040aa84
                                                                                          0x0040aa86
                                                                                          0x0040aaad
                                                                                          0x0040aabf
                                                                                          0x0040aac1
                                                                                          0x00000000
                                                                                          0x0040aac1
                                                                                          0x0040aa84
                                                                                          0x0040aa62
                                                                                          0x00000000
                                                                                          0x0040aa23
                                                                                          0x0040aad9
                                                                                          0x0040aad9
                                                                                          0x0040a9eb
                                                                                          0x0040a9c9
                                                                                          0x0040a9b5
                                                                                          0x0040a99e
                                                                                          0x0040a950
                                                                                          0x0040a95b
                                                                                          0x0040a95f
                                                                                          0x00000000
                                                                                          0x0040a961
                                                                                          0x0040a961
                                                                                          0x0040a96c
                                                                                          0x0040a970
                                                                                          0x0040a975
                                                                                          0x00000000
                                                                                          0x0040a977
                                                                                          0x0040a983
                                                                                          0x0040a983
                                                                                          0x0040a975
                                                                                          0x0040a95f
                                                                                          0x0040aade
                                                                                          0x0040aae7

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,004162BC,?,?), ref: 0040A945
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A956
                                                                                          • FindFirstFileW.KERNEL32(?,?,kernel32.dll,004162BC,?,?), ref: 0040AA56
                                                                                          • FindClose.KERNEL32(?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AA68
                                                                                          • lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AA74
                                                                                          • lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AAB9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                          • String ID: GetLongPathNameW$\$kernel32.dll
                                                                                          • API String ID: 1930782624-3908791685
                                                                                          • Opcode ID: 2e7747c66ca0daf9bf73dcf24122f514d4f35ae2d915a4be054088bbf24f0c4d
                                                                                          • Instruction ID: 0568a8f2c4c85ac628058e700237ad117df8c3680498263a44950cac296231c5
                                                                                          • Opcode Fuzzy Hash: 2e7747c66ca0daf9bf73dcf24122f514d4f35ae2d915a4be054088bbf24f0c4d
                                                                                          • Instruction Fuzzy Hash: 7841A071B003189BCB20DE98CD85A9EB3B5AB44310F1485B69945F72C1EB7CAE51CF4A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF110 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 91%
                                                                                          			E004AF110() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t7;

				if(E0041FF2C() != 2) {
					L5:
					_t7 = ExitWindowsEx(2, 0);
					asm("sbb eax, eax");
					return _t7 + 1;
				}
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) != 0) {
					LookupPrivilegeValueW(0, L"SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() == 0) {
						goto L5;
					}
					return 0;
				}
				return 0;
			}







                                                                                          0x004af11b
                                                                                          0x004af178
                                                                                          0x004af17c
                                                                                          0x004af184
                                                                                          0x00000000
                                                                                          0x004af186
                                                                                          0x004af12d
                                                                                          0x004af13f
                                                                                          0x004af144
                                                                                          0x004af14c
                                                                                          0x004af166
                                                                                          0x004af172
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af174
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000028), ref: 004AF120
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004AF126
                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004AF13F
                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004AF166
                                                                                          • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004AF16B
                                                                                          • ExitWindowsEx.USER32 ref: 004AF17C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                          • String ID: SeShutdownPrivilege
                                                                                          • API String ID: 107509674-3733053543
                                                                                          • Opcode ID: dbd0b99069aff0d6788c9efc2bbd2c2bb6d4dae2a155ecb9c3cc528dabbfbf9f
                                                                                          • Instruction ID: 15d82be9bc359c8987119149698676c325083c88dcd196a4f2f9cd1a299335ef
                                                                                          • Opcode Fuzzy Hash: dbd0b99069aff0d6788c9efc2bbd2c2bb6d4dae2a155ecb9c3cc528dabbfbf9f
                                                                                          • Instruction Fuzzy Hash: 75F06D70684301B5E610A6F2CD07F6B21C89B56B58FA00D3EBA84E91C2D7BDD81D42BF
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF9F0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004AF9F0() {
				struct HRSRC__* _t10;
				void* _t11;
				void* _t12;

				_t10 = FindResourceW(0, 0x2b67, 0xa);
				if(_t10 == 0) {
					E004AF834();
				}
				if(SizeofResource(0, _t10) != 0x2c) {
					E004AF834();
				}
				_t11 = LoadResource(0, _t10);
				if(_t11 == 0) {
					E004AF834();
				}
				_t12 = LockResource(_t11);
				if(_t12 == 0) {
					E004AF834();
				}
				return _t12;
			}






                                                                                          0x004af9ff
                                                                                          0x004afa03
                                                                                          0x004afa05
                                                                                          0x004afa05
                                                                                          0x004afa15
                                                                                          0x004afa17
                                                                                          0x004afa17
                                                                                          0x004afa24
                                                                                          0x004afa28
                                                                                          0x004afa2a
                                                                                          0x004afa2a
                                                                                          0x004afa35
                                                                                          0x004afa39
                                                                                          0x004afa3b
                                                                                          0x004afa3b
                                                                                          0x004afa43

                                                                                          APIs
                                                                                          • FindResourceW.KERNEL32(00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000,004B659E,?,00000000,004B65E2), ref: 004AF9FA
                                                                                          • SizeofResource.KERNEL32(00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000,004B659E), ref: 004AFA0D
                                                                                          • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000), ref: 004AFA1F
                                                                                          • LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002), ref: 004AFA30
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadLockSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 3473537107-0
                                                                                          • Opcode ID: 128b44542abe6d6e0e09835f67cf23f4a4e4be27e5836866f54195567a651b81
                                                                                          • Instruction ID: 8c15b2061d88d30e204a2d131290402b8da5209396f43898e5d703764eea749b
                                                                                          • Opcode Fuzzy Hash: 128b44542abe6d6e0e09835f67cf23f4a4e4be27e5836866f54195567a651b81
                                                                                          • Instruction Fuzzy Hash: FCE07E8074634625FA6436F718D7BAE00084B36B4DF40593FFA08A92D2EEAC8C19522E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040A4CC Relevance: 4.6, APIs: 3, Instructions: 99COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E0040A4CC(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				short _v182;
				short _v352;
				char _v356;
				char _v360;
				char _v364;
				int _t58;
				signed int _t61;
				intOrPtr _t70;
				signed short _t80;
				void* _t83;
				void* _t85;
				void* _t86;

				_t77 = __edi;
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v364 = 0;
				_v8 = __edx;
				_t80 = __eax;
				_push(_t83);
				_push(0x40a631);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xfffffe98;
				E00407A20(_v8);
				_t85 = _t80 -  *0x4b7a08; // 0x404
				if(_t85 >= 0) {
					_t86 = _t80 -  *0x4b7c08; // 0x7c68
					if(_t86 <= 0) {
						_t77 = 0x40;
						_v12 = 0;
						if(0x40 >= _v12) {
							do {
								_t61 = _t77 + _v12 >> 1;
								if(_t80 >=  *((intOrPtr*)(0x4b7a08 + _t61 * 8))) {
									__eflags = _t80 -  *((intOrPtr*)(0x4b7a08 + _t61 * 8));
									if(__eflags <= 0) {
										E0040A3EC( *((intOrPtr*)(0x4b7a0c + _t61 * 8)), _t61, _v8, _t77, _t80, __eflags);
									} else {
										_v12 = _t61 + 1;
										goto L8;
									}
								} else {
									_t77 = _t61 - 1;
									goto L8;
								}
								goto L9;
								L8:
							} while (_t77 >= _v12);
						}
					}
				}
				L9:
				if( *_v8 == 0 && IsValidLocale(_t80 & 0x0000ffff, 2) != 0) {
					_t58 = _t80 & 0x0000ffff;
					GetLocaleInfoW(_t58, 0x59,  &_v182, 0x55);
					GetLocaleInfoW(_t58, 0x5a,  &_v352, 0x55);
					E0040858C( &_v356, 0x55,  &_v182);
					_push(_v356);
					_push(0x40a64c);
					E0040858C( &_v360, 0x55,  &_v352);
					_push(_v360);
					_push(E0040A65C);
					E0040858C( &_v364, 0x55,  &_v182);
					_push(_v364);
					E004087C4(_v8, _t58, 5, _t77, _t80);
				}
				_pop(_t70);
				 *[fs:eax] = _t70;
				_push(E0040A638);
				return E00407A80( &_v364, 3);
			}

















                                                                                          0x0040a4cc
                                                                                          0x0040a4d7
                                                                                          0x0040a4da
                                                                                          0x0040a4e0
                                                                                          0x0040a4e6
                                                                                          0x0040a4ec
                                                                                          0x0040a4ef
                                                                                          0x0040a4f3
                                                                                          0x0040a4f4
                                                                                          0x0040a4f9
                                                                                          0x0040a4fc
                                                                                          0x0040a502
                                                                                          0x0040a507
                                                                                          0x0040a50e
                                                                                          0x0040a510
                                                                                          0x0040a517
                                                                                          0x0040a519
                                                                                          0x0040a520
                                                                                          0x0040a526
                                                                                          0x0040a528
                                                                                          0x0040a52d
                                                                                          0x0040a537
                                                                                          0x0040a53e
                                                                                          0x0040a546
                                                                                          0x0040a558
                                                                                          0x0040a548
                                                                                          0x0040a549
                                                                                          0x00000000
                                                                                          0x0040a549
                                                                                          0x0040a539
                                                                                          0x0040a53b
                                                                                          0x00000000
                                                                                          0x0040a53b
                                                                                          0x00000000
                                                                                          0x0040a55f
                                                                                          0x0040a55f
                                                                                          0x0040a528
                                                                                          0x0040a526
                                                                                          0x0040a517
                                                                                          0x0040a564
                                                                                          0x0040a56a
                                                                                          0x0040a58e
                                                                                          0x0040a592
                                                                                          0x0040a5a3
                                                                                          0x0040a5b9
                                                                                          0x0040a5be
                                                                                          0x0040a5c4
                                                                                          0x0040a5da
                                                                                          0x0040a5df
                                                                                          0x0040a5e5
                                                                                          0x0040a5fb
                                                                                          0x0040a600
                                                                                          0x0040a60e
                                                                                          0x0040a60e
                                                                                          0x0040a615
                                                                                          0x0040a618
                                                                                          0x0040a61b
                                                                                          0x0040a630

                                                                                          APIs
                                                                                          • IsValidLocale.KERNEL32(?,00000002,00000000,0040A631,?,004162BC,?,00000000), ref: 0040A576
                                                                                          • GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040A631,?,004162BC,?,00000000), ref: 0040A592
                                                                                          • GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040A631,?,004162BC,?,00000000), ref: 0040A5A3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Locale$Info$Valid
                                                                                          • String ID:
                                                                                          • API String ID: 1826331170-0
                                                                                          • Opcode ID: 62325bdbcd9f8bf22caa424e6d98428fadf2f4ef7d6ad95b5286de9b97f55654
                                                                                          • Instruction ID: 92a11a0233c3b219485afac9e49f2dea99407596d6f7a83949ef3a6145fdf69e
                                                                                          • Opcode Fuzzy Hash: 62325bdbcd9f8bf22caa424e6d98428fadf2f4ef7d6ad95b5286de9b97f55654
                                                                                          • Instruction Fuzzy Hash: 3831AE70A00308ABDF20DB64DD81BDEBBB9FB48701F5005BBA508B32D1D6395E90CE1A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041A4DC Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0041A4DC(WCHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				WCHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceW(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E004095A8(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E004095A8(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

















                                                                                          0x0041a4e3
                                                                                          0x0041a4e8
                                                                                          0x0041a4ea
                                                                                          0x0041a4ea
                                                                                          0x0041a4fd
                                                                                          0x0041a50c
                                                                                          0x0041a50f
                                                                                          0x0041a51c
                                                                                          0x0041a51f
                                                                                          0x0041a524
                                                                                          0x0041a527
                                                                                          0x0041a529
                                                                                          0x0041a536
                                                                                          0x0041a539
                                                                                          0x0041a53e
                                                                                          0x0041a541
                                                                                          0x0041a543
                                                                                          0x0041a54c

                                                                                          APIs
                                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041A4FD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DiskFreeSpace
                                                                                          • String ID:
                                                                                          • API String ID: 1705453755-0
                                                                                          • Opcode ID: 35fab30d3ed47bb79bc7b5801678cd6b626cb6661b26d0a6d4a2aa78d0844cce
                                                                                          • Instruction ID: 14c90aad059d6341cd8fbca9d1c94cd423dd62e4f1f0ed92fc39ecac232c4210
                                                                                          • Opcode Fuzzy Hash: 35fab30d3ed47bb79bc7b5801678cd6b626cb6661b26d0a6d4a2aa78d0844cce
                                                                                          • Instruction Fuzzy Hash: 7711C0B5A01209AFDB04CF9ACD819EFB7F9EFC8304B14C569A505E7255E6319E018B94
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041E034 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0041E034(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				short _v516;
				void* __ebp;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoW(__eax, __edx,  &_v516, 0x100);
				_t19 = _t5;
				if(_t5 <= 0) {
					return E00407E00(_t10, _t18);
				}
				return E00407BA8(_t10, _t5 - 1,  &_v516, _t19);
			}








                                                                                          0x0041e03f
                                                                                          0x0041e041
                                                                                          0x0041e052
                                                                                          0x0041e057
                                                                                          0x0041e059
                                                                                          0x00000000
                                                                                          0x0041e071
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041E052
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: d1249f9bfb9152180de995f4510b089303b0330b3d36e5e1fa950d916a740853
                                                                                          • Instruction ID: c90943d4e22265a1f7ecf9aede9ac9faa011377f579ac525cbc4109061889d1c
                                                                                          • Opcode Fuzzy Hash: d1249f9bfb9152180de995f4510b089303b0330b3d36e5e1fa950d916a740853
                                                                                          • Instruction Fuzzy Hash: C7E09235B0421427E314A55A9C86AE7725D9B48340F40457FBD05D7382EDB9AE8042E9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041E080 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 79%
                                                                                          			E0041E080(int __eax, signed int __ecx, int __edx) {
				short _v16;
				signed int _t5;
				signed int _t10;

				_push(__ecx);
				_t10 = __ecx;
				if(GetLocaleInfoW(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t10;
				} else {
					_t5 = _v16 & 0x0000ffff;
				}
				return _t5;
			}






                                                                                          0x0041e083
                                                                                          0x0041e084
                                                                                          0x0041e09a
                                                                                          0x0041e0a2
                                                                                          0x0041e09c
                                                                                          0x0041e09c
                                                                                          0x0041e09c
                                                                                          0x0041e0a8

                                                                                          APIs
                                                                                          • GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041E182,?,00000001,00000000,0041E391), ref: 0041E093
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: c2a2e253f202cad765f8f9b35123567cb33a3e9031303696ff7b3b42dc5ba059
                                                                                          • Instruction ID: 961adf842b5e4829a7f1cb68f4be235500f18d0b61d537998bbd462cca006134
                                                                                          • Opcode Fuzzy Hash: c2a2e253f202cad765f8f9b35123567cb33a3e9031303696ff7b3b42dc5ba059
                                                                                          • Instruction Fuzzy Hash: 45D05EBA31923476E214915B6E85DB75ADCCBC87A2F14483BBE4CC6241D2A4CC46A275
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF218 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004AF218(signed int __eax) {
				short _v8;
				signed int _t6;

				_t6 = GetLocaleInfoW(__eax & 0x0000ffff, 0x20001004,  &_v8, 2);
				if(_t6 <= 0) {
					return _t6 | 0xffffffff;
				}
				return _v8;
			}





                                                                                          0x004af22e
                                                                                          0x004af235
                                                                                          0x00000000
                                                                                          0x004af23c
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,004AF318), ref: 004AF22E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: 91ef75d91c3bf0fbfb4c903f00eadddcc0e9dd42321a82c412adf8826a4a964a
                                                                                          • Instruction ID: 3cbbb47bc5e3852376f83ef88ad8e7e21f22c900a58d153b56eed97a123c5839
                                                                                          • Opcode Fuzzy Hash: 91ef75d91c3bf0fbfb4c903f00eadddcc0e9dd42321a82c412adf8826a4a964a
                                                                                          • Instruction Fuzzy Hash: E8D0A5F55442087DF504C1DA5D82FB673DCD705374F500767F654C52C1D567EE015219
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041C3D8 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0041C3D8() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear & 0x0000ffff;
			}




                                                                                          0x0041c3dc
                                                                                          0x0041c3e8

                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: LocalTime
                                                                                          • String ID:
                                                                                          • API String ID: 481472006-0
                                                                                          • Opcode ID: 2bbd9f916a85fd19aaf3e135de3c6f6031220cebfdbc254b78c71648618a48a1
                                                                                          • Instruction ID: 79eafb11b28f80ce797d6e9fe134e5764476c7cb5db39d72cf417c4d7be8b418
                                                                                          • Opcode Fuzzy Hash: 2bbd9f916a85fd19aaf3e135de3c6f6031220cebfdbc254b78c71648618a48a1
                                                                                          • Instruction Fuzzy Hash: DAA0122080582011D140331A0C0313530405900620FC40F55BCF8542D1E93D013440D7
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405AE0 Relevance: .0, Instructions: 14COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
                                                                                          • Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
                                                                                          • Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
                                                                                          • Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00427874 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00427874() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x4c1134 = E00427848("VariantChangeTypeEx", E00427264, _t91);
				 *0x4c1138 = E00427848("VarNeg", E004272AC, _t91);
				 *0x4c113c = E00427848("VarNot", E004272AC, _t91);
				 *0x4c1140 = E00427848("VarAdd", E004272B8, _t91);
				 *0x4c1144 = E00427848("VarSub", E004272B8, _t91);
				 *0x4c1148 = E00427848("VarMul", E004272B8, _t91);
				 *0x4c114c = E00427848("VarDiv", E004272B8, _t91);
				 *0x4c1150 = E00427848("VarIdiv", E004272B8, _t91);
				 *0x4c1154 = E00427848("VarMod", E004272B8, _t91);
				 *0x4c1158 = E00427848("VarAnd", E004272B8, _t91);
				 *0x4c115c = E00427848("VarOr", E004272B8, _t91);
				 *0x4c1160 = E00427848("VarXor", E004272B8, _t91);
				 *0x4c1164 = E00427848("VarCmp", E004272C4, _t91);
				 *0x4c1168 = E00427848("VarI4FromStr", E004272D0, _t91);
				 *0x4c116c = E00427848("VarR4FromStr", E0042733C, _t91);
				 *0x4c1170 = E00427848("VarR8FromStr", E004273AC, _t91);
				 *0x4c1174 = E00427848("VarDateFromStr", E0042741C, _t91);
				 *0x4c1178 = E00427848("VarCyFromStr", E0042748C, _t91);
				 *0x4c117c = E00427848("VarBoolFromStr", E004274FC, _t91);
				 *0x4c1180 = E00427848("VarBstrFromCy", E0042757C, _t91);
				 *0x4c1184 = E00427848("VarBstrFromDate", E00427624, _t91);
				_t46 = E00427848("VarBstrFromBool", E004277B4, _t91);
				 *0x4c1188 = _t46;
				return _t46;
			}






                                                                                          0x00427882
                                                                                          0x00427896
                                                                                          0x004278ac
                                                                                          0x004278c2
                                                                                          0x004278d8
                                                                                          0x004278ee
                                                                                          0x00427904
                                                                                          0x0042791a
                                                                                          0x00427930
                                                                                          0x00427946
                                                                                          0x0042795c
                                                                                          0x00427972
                                                                                          0x00427988
                                                                                          0x0042799e
                                                                                          0x004279b4
                                                                                          0x004279ca
                                                                                          0x004279e0
                                                                                          0x004279f6
                                                                                          0x00427a0c
                                                                                          0x00427a22
                                                                                          0x00427a38
                                                                                          0x00427a4e
                                                                                          0x00427a5e
                                                                                          0x00427a64
                                                                                          0x00427a6b

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042787D
                                                                                            • Part of subcall function 00427848: GetProcAddress.KERNEL32(00000000), ref: 00427861
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                          • API String ID: 1646373207-1918263038
                                                                                          • Opcode ID: 3edd394f2c42f1ee7728dbbd964d2d48b2f407ea9c7b21d0b846acf91e36c10d
                                                                                          • Instruction ID: afb448a43cf45882875cbd5333393c9475fd06a837c60371df2c799b3a2ca9d5
                                                                                          • Opcode Fuzzy Hash: 3edd394f2c42f1ee7728dbbd964d2d48b2f407ea9c7b21d0b846acf91e36c10d
                                                                                          • Instruction Fuzzy Hash: 4741442078D2689A53007BAA3C0692A7B9CD64A7243E0E07FF5048B766DF7CAC40867D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040A250 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0040A250() {
				signed int _t2;
				_Unknown_base(*)()* _t8;

				InitializeCriticalSection(0x4bdc10);
				 *0x4bdc28 = 0x7f;
				_t2 = GetVersion() & 0x000000ff;
				 *0x4bdc0c = _t2 - 6 >= 0;
				if( *0x4bdc0c != 0) {
					 *0x4bdc00 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadPreferredUILanguages");
					 *0x4bdc04 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "SetThreadPreferredUILanguages");
					_t8 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadUILanguage");
					 *0x4bdc08 = _t8;
					return _t8;
				}
				return _t2;
			}





                                                                                          0x0040a255
                                                                                          0x0040a25a
                                                                                          0x0040a268
                                                                                          0x0040a270
                                                                                          0x0040a27e
                                                                                          0x0040a295
                                                                                          0x0040a2af
                                                                                          0x0040a2c4
                                                                                          0x0040a2c9
                                                                                          0x00000000
                                                                                          0x0040a2c9
                                                                                          0x0040a2ce

                                                                                          APIs
                                                                                          • InitializeCriticalSection.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A255
                                                                                          • GetVersion.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A263
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A28A
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A290
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2A4
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2AA
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2BE
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2C4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
                                                                                          • String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
                                                                                          • API String ID: 74573329-1403180336
                                                                                          • Opcode ID: 58d327082e64ef42c945ef42cd8e374577ec01c28157982806072b66866d47a0
                                                                                          • Instruction ID: d84369935ce7e940d286def53580bf621e493dc20acbcc0033f4522394103be5
                                                                                          • Opcode Fuzzy Hash: 58d327082e64ef42c945ef42cd8e374577ec01c28157982806072b66866d47a0
                                                                                          • Instruction Fuzzy Hash: F9F098A49853413DD6207F769D07B292D685A0170AF644AFFB410763D3EEFE4190E71E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041E0AC Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 216threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E0041E0AC(int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				int _t55;
				void* _t121;
				void* _t128;
				void* _t151;
				void* _t152;
				intOrPtr _t172;
				intOrPtr _t204;
				signed short _t212;
				int _t214;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t224;

				_t224 = __fp0;
				_t211 = __edi;
				_t216 = _t217;
				_t152 = 7;
				do {
					_push(0);
					_push(0);
					_t152 = _t152 - 1;
				} while (_t152 != 0);
				_push(__edi);
				_t151 = __edx;
				_t214 = __eax;
				_push(_t216);
				_push(0x41e391);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				_t55 = IsValidLocale(__eax, 1);
				_t219 = _t55;
				if(_t55 == 0) {
					_t214 = GetThreadLocale();
				}
				_t172 =  *0x416f50; // 0x416f54
				E00409D24(_t151 + 0xbc, _t172);
				E0041E7CC(_t214, _t151, _t151, _t211, _t214, _t224);
				E0041E4A0(_t214, _t151, _t151, _t211, _t214);
				E0041E55C(_t214, _t151, _t151, _t211, _t214);
				E0041E034(_t214, 0, 0x14,  &_v20);
				E00407E00(_t151, _v20);
				E0041E034(_t214, 0x41e3ac, 0x1b,  &_v24);
				 *((char*)(_t151 + 4)) = E0041A1C4(0x41e3ac, 0, _t219);
				E0041E034(_t214, 0x41e3ac, 0x1c,  &_v28);
				 *((char*)(_t151 + 0xc6)) = E0041A1C4(0x41e3ac, 0, _t219);
				 *((short*)(_t151 + 0xc0)) = E0041E080(_t214, 0x2c, 0xf);
				 *((short*)(_t151 + 0xc2)) = E0041E080(_t214, 0x2e, 0xe);
				E0041E034(_t214, 0x41e3ac, 0x19,  &_v32);
				 *((char*)(_t151 + 5)) = E0041A1C4(0x41e3ac, 0, _t219);
				_t212 = E0041E080(_t214, 0x2f, 0x1d);
				 *(_t151 + 6) = _t212;
				_push(_t212);
				E0041EB18(_t214, _t151, L"m/d/yy", 0x1f, _t212, _t214, _t219,  &_v36);
				E00407E00(_t151 + 0xc, _v36);
				_push( *(_t151 + 6) & 0x0000ffff);
				E0041EB18(_t214, _t151, L"mmmm d, yyyy", 0x20, _t212, _t214, _t219,  &_v40);
				E00407E00(_t151 + 0x10, _v40);
				 *((short*)(_t151 + 8)) = E0041E080(_t214, 0x3a, 0x1e);
				E0041E034(_t214, 0x41e400, 0x28,  &_v44);
				E00407E00(_t151 + 0x14, _v44);
				E0041E034(_t214, 0x41e414, 0x29,  &_v48);
				E00407E00(_t151 + 0x18, _v48);
				E00407A20( &_v12);
				E00407A20( &_v16);
				E0041E034(_t214, 0x41e3ac, 0x25,  &_v52);
				_t121 = E0041A1C4(0x41e3ac, 0, _t219);
				_t220 = _t121;
				if(_t121 != 0) {
					E00407E48( &_v8, 0x41e438);
				} else {
					E00407E48( &_v8, 0x41e428);
				}
				E0041E034(_t214, 0x41e3ac, 0x23,  &_v56);
				_t128 = E0041A1C4(0x41e3ac, 0, _t220);
				_t221 = _t128;
				if(_t128 == 0) {
					E0041E034(_t214, 0x41e3ac, 0x1005,  &_v60);
					if(E0041A1C4(0x41e3ac, 0, _t221) != 0) {
						E00407E48( &_v12, L"AMPM ");
					} else {
						E00407E48( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E004087C4(_t151 + 0x1c, _t151, 4, _t212, _t214);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E004087C4(_t151 + 0x20, _t151, 4, _t212, _t214);
				 *((short*)(_t151 + 0xa)) = E0041E080(_t214, 0x2c, 0xc);
				 *((short*)(_t151 + 0xc4)) = 0x32;
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(0x41e398);
				return E00407A80( &_v60, 0xe);
			}





























                                                                                          0x0041e0ac
                                                                                          0x0041e0ac
                                                                                          0x0041e0ad
                                                                                          0x0041e0af
                                                                                          0x0041e0b4
                                                                                          0x0041e0b4
                                                                                          0x0041e0b6
                                                                                          0x0041e0b8
                                                                                          0x0041e0b8
                                                                                          0x0041e0bd
                                                                                          0x0041e0be
                                                                                          0x0041e0c0
                                                                                          0x0041e0c4
                                                                                          0x0041e0c5
                                                                                          0x0041e0ca
                                                                                          0x0041e0cd
                                                                                          0x0041e0d3
                                                                                          0x0041e0d8
                                                                                          0x0041e0da
                                                                                          0x0041e0e1
                                                                                          0x0041e0e1
                                                                                          0x0041e0e9
                                                                                          0x0041e0ef
                                                                                          0x0041e0f8
                                                                                          0x0041e101
                                                                                          0x0041e10a
                                                                                          0x0041e11c
                                                                                          0x0041e126
                                                                                          0x0041e13b
                                                                                          0x0041e14a
                                                                                          0x0041e15d
                                                                                          0x0041e16c
                                                                                          0x0041e182
                                                                                          0x0041e199
                                                                                          0x0041e1b0
                                                                                          0x0041e1bf
                                                                                          0x0041e1d2
                                                                                          0x0041e1d4
                                                                                          0x0041e1d8
                                                                                          0x0041e1e9
                                                                                          0x0041e1f4
                                                                                          0x0041e1fd
                                                                                          0x0041e20e
                                                                                          0x0041e219
                                                                                          0x0041e22e
                                                                                          0x0041e242
                                                                                          0x0041e24d
                                                                                          0x0041e262
                                                                                          0x0041e26d
                                                                                          0x0041e275
                                                                                          0x0041e27d
                                                                                          0x0041e292
                                                                                          0x0041e29c
                                                                                          0x0041e2a1
                                                                                          0x0041e2a3
                                                                                          0x0041e2bc
                                                                                          0x0041e2a5
                                                                                          0x0041e2ad
                                                                                          0x0041e2ad
                                                                                          0x0041e2d1
                                                                                          0x0041e2db
                                                                                          0x0041e2e0
                                                                                          0x0041e2e2
                                                                                          0x0041e2f4
                                                                                          0x0041e305
                                                                                          0x0041e31e
                                                                                          0x0041e307
                                                                                          0x0041e30f
                                                                                          0x0041e30f
                                                                                          0x0041e305
                                                                                          0x0041e323
                                                                                          0x0041e326
                                                                                          0x0041e329
                                                                                          0x0041e32e
                                                                                          0x0041e339
                                                                                          0x0041e33e
                                                                                          0x0041e341
                                                                                          0x0041e344
                                                                                          0x0041e349
                                                                                          0x0041e354
                                                                                          0x0041e369
                                                                                          0x0041e36d
                                                                                          0x0041e378
                                                                                          0x0041e37b
                                                                                          0x0041e37e
                                                                                          0x0041e390

                                                                                          APIs
                                                                                          • IsValidLocale.KERNEL32(?,00000001,00000000,0041E391,?,?,?,?,00000000,00000000), ref: 0041E0D3
                                                                                          • GetThreadLocale.KERNEL32(?,00000001,00000000,0041E391,?,?,?,?,00000000,00000000), ref: 0041E0DC
                                                                                            • Part of subcall function 0041E080: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041E182,?,00000001,00000000,0041E391), ref: 0041E093
                                                                                            • Part of subcall function 0041E034: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041E052
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Locale$Info$ThreadValid
                                                                                          • String ID: AMPM$2$:mm$:mm:ss$AMPM $ToA$m/d/yy$mmmm d, yyyy
                                                                                          • API String ID: 233154393-2808312488
                                                                                          • Opcode ID: 89dbd54baef797781c63ab5ee0a362cfcea0ac090ff54d53303b749289e312d8
                                                                                          • Instruction ID: 756c878950b08f5201d8436663b045c7a1b9734561897f0b9d621fb0846820d7
                                                                                          • Opcode Fuzzy Hash: 89dbd54baef797781c63ab5ee0a362cfcea0ac090ff54d53303b749289e312d8
                                                                                          • Instruction Fuzzy Hash: 887134387011199BDB05EB67C841BDE76AADF88304F50807BF904AB246DB3DDD82879E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041E7CC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 83%
                                                                                          			E0041E7CC(void* __eax, void* __ebx, signed int __edx, void* __edi, void* __esi, long long __fp0) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _t32;
				intOrPtr _t33;
				signed int _t49;
				signed int _t53;
				signed int _t56;
				intOrPtr _t58;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t75;
				signed int _t78;
				signed int* _t82;
				signed int _t85;
				void* _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				void* _t105;
				intOrPtr _t106;
				signed int _t109;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				void* _t131;
				void* _t132;
				signed int _t134;
				void* _t136;
				void* _t137;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				long long _t161;

				_t161 = __fp0;
				_t126 = __edi;
				_t109 = __edx;
				_t139 = _t140;
				_t141 = _t140 + 0xfffffff0;
				_push(__edi);
				_v12 = 0;
				_v8 = __edx;
				_t93 = __eax;
				_push(_t139);
				_push(0x41ea61);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141;
				_t32 =  *0x4ba590; // 0x4bb8f8
				_t144 =  *_t32;
				if( *_t32 == 0) {
					E0040554C(0x1a);
				}
				_t33 =  *0x4be7e4; // 0x2318830
				E00406688(E0040690C(_t33, 0, _t126), _t109 | 0xffffffff, _t144);
				_push(_t139);
				_push(0x41ea44);
				_push( *[fs:edx]);
				 *[fs:edx] = _t141;
				 *0x4be7dc = 0;
				_push(0);
				E00409C00();
				_t142 = _t141 + 4;
				E0041E034(_t93, 0x41ea7c, 0x100b,  &_v12);
				_t127 = E0041A1C4(0x41ea7c, 1, _t144);
				if(_t127 + 0xfffffffd - 3 >= 0) {
					__eflags = _t127 - 0xffffffffffffffff;
					if(_t127 - 0xffffffffffffffff < 0) {
						 *0x4be7dc = 1;
						_push(1);
						E00409C00();
						_t142 = _t142 + 4;
						_t68 =  *0x4be7e0; // 0x0
						E00407E00(_t68, L"B.C.");
						_t70 =  *0x4be7e0; // 0x0
						 *((intOrPtr*)(_t70 + 4)) = 0;
						_t71 =  *0x4be7e0; // 0x0
						 *((intOrPtr*)(_t71 + 8)) = 0xffc00000;
						 *((intOrPtr*)(_t71 + 0xc)) = 0xc1dfffff;
						E0041C1C4(1, 1, 1, __eflags, _t161);
						_v20 = E00405790();
						_v16 = 1;
						asm("fild qword [ebp-0x10]");
						_t75 =  *0x4be7e0; // 0x0
						 *((long long*)(_t75 + 0x10)) = _t161;
						asm("wait");
						EnumCalendarInfoW(E0041E6A4, GetThreadLocale(), _t127, 4);
						_t78 =  *0x4be7e0; // 0x0
						__eflags = _t78;
						if(_t78 != 0) {
							_t82 = _t78 - 4;
							__eflags = _t82;
							_t78 =  *_t82;
						}
						_t134 = _t78 - 1;
						__eflags = _t134;
						if(_t134 > 0) {
							_t98 = 1;
							do {
								_t124 =  *0x4be7e0; // 0x0
								 *((intOrPtr*)(_t124 + 4 + (_t98 + _t98 * 2) * 8)) = 0xffffffff;
								_t98 = _t98 + 1;
								_t134 = _t134 - 1;
								__eflags = _t134;
							} while (_t134 != 0);
						}
						EnumCalendarInfoW(E0041E73C, GetThreadLocale(), _t127, 3);
					}
				} else {
					EnumCalendarInfoW(E0041E6A4, GetThreadLocale(), _t127, 4);
					_t85 =  *0x4be7e0; // 0x0
					if(_t85 != 0) {
						_t85 =  *(_t85 - 4);
					}
					_t136 = _t85 - 1;
					if(_t136 >= 0) {
						_t137 = _t136 + 1;
						_t99 = 0;
						do {
							_t125 =  *0x4be7e0; // 0x0
							 *((intOrPtr*)(_t125 + 4 + (_t99 + _t99 * 2) * 8)) = 0xffffffff;
							_t99 = _t99 + 1;
							_t137 = _t137 - 1;
						} while (_t137 != 0);
					}
					EnumCalendarInfoW(E0041E73C, GetThreadLocale(), _t127, 3);
				}
				_t49 =  *0x4be7e0; // 0x0
				_t94 = _t49;
				if(_t94 != 0) {
					_t94 =  *(_t94 - 4);
				}
				_push(_t94);
				E00409C00();
				_t53 =  *0x4be7e0; // 0x0
				if(_t53 != 0) {
					_t53 =  *(_t53 - 4);
				}
				_t131 = _t53 - 1;
				if(_t131 >= 0) {
					_t132 = _t131 + 1;
					_t95 = 0;
					do {
						_t127 = _t95 + _t95 * 2;
						_t118 =  *0x4be7e0; // 0x0
						_t106 =  *0x416e18; // 0x416e1c
						E00408F5C( *((intOrPtr*)(_v8 + 0xbc)) + (_t95 + _t95 * 2) * 8, _t106, _t118 + (_t95 + _t95 * 2) * 8);
						_t95 = _t95 + 1;
						_t132 = _t132 - 1;
					} while (_t132 != 0);
				}
				_t116 =  *0x41e600; // 0x41e604
				E00409D24(0x4be7e0, _t116);
				_t56 =  *0x4be7e0; // 0x0
				if(_t56 != 0) {
					_t56 =  *(_t56 - 4);
				}
				 *0x4be7dc = _t56;
				_pop(_t117);
				_pop(_t105);
				 *[fs:eax] = _t117;
				_push(0x41ea4b);
				_t58 =  *0x4be7e4; // 0x2318830
				return E00406868(_t58, _t105, _t127);
			}











































                                                                                          0x0041e7cc
                                                                                          0x0041e7cc
                                                                                          0x0041e7cc
                                                                                          0x0041e7cd
                                                                                          0x0041e7cf
                                                                                          0x0041e7d4
                                                                                          0x0041e7d7
                                                                                          0x0041e7da
                                                                                          0x0041e7dd
                                                                                          0x0041e7e1
                                                                                          0x0041e7e2
                                                                                          0x0041e7e7
                                                                                          0x0041e7ea
                                                                                          0x0041e7ed
                                                                                          0x0041e7f2
                                                                                          0x0041e7f5
                                                                                          0x0041e7f9
                                                                                          0x0041e7f9
                                                                                          0x0041e7fe
                                                                                          0x0041e80b
                                                                                          0x0041e812
                                                                                          0x0041e813
                                                                                          0x0041e818
                                                                                          0x0041e81b
                                                                                          0x0041e820
                                                                                          0x0041e826
                                                                                          0x0041e837
                                                                                          0x0041e83c
                                                                                          0x0041e84f
                                                                                          0x0041e861
                                                                                          0x0041e86b
                                                                                          0x0041e8c8
                                                                                          0x0041e8cb
                                                                                          0x0041e8d6
                                                                                          0x0041e8dc
                                                                                          0x0041e8ed
                                                                                          0x0041e8f2
                                                                                          0x0041e8f5
                                                                                          0x0041e8ff
                                                                                          0x0041e904
                                                                                          0x0041e90b
                                                                                          0x0041e90e
                                                                                          0x0041e913
                                                                                          0x0041e91a
                                                                                          0x0041e92d
                                                                                          0x0041e937
                                                                                          0x0041e93a
                                                                                          0x0041e93d
                                                                                          0x0041e940
                                                                                          0x0041e945
                                                                                          0x0041e948
                                                                                          0x0041e957
                                                                                          0x0041e95c
                                                                                          0x0041e961
                                                                                          0x0041e963
                                                                                          0x0041e965
                                                                                          0x0041e965
                                                                                          0x0041e968
                                                                                          0x0041e968
                                                                                          0x0041e96c
                                                                                          0x0041e96d
                                                                                          0x0041e96f
                                                                                          0x0041e971
                                                                                          0x0041e976
                                                                                          0x0041e979
                                                                                          0x0041e97f
                                                                                          0x0041e987
                                                                                          0x0041e988
                                                                                          0x0041e988
                                                                                          0x0041e988
                                                                                          0x0041e976
                                                                                          0x0041e999
                                                                                          0x0041e999
                                                                                          0x0041e86d
                                                                                          0x0041e87b
                                                                                          0x0041e880
                                                                                          0x0041e887
                                                                                          0x0041e88c
                                                                                          0x0041e88c
                                                                                          0x0041e890
                                                                                          0x0041e893
                                                                                          0x0041e895
                                                                                          0x0041e896
                                                                                          0x0041e898
                                                                                          0x0041e89b
                                                                                          0x0041e8a1
                                                                                          0x0041e8a9
                                                                                          0x0041e8aa
                                                                                          0x0041e8aa
                                                                                          0x0041e898
                                                                                          0x0041e8bb
                                                                                          0x0041e8bb
                                                                                          0x0041e99e
                                                                                          0x0041e9a3
                                                                                          0x0041e9a7
                                                                                          0x0041e9ac
                                                                                          0x0041e9ac
                                                                                          0x0041e9ae
                                                                                          0x0041e9c2
                                                                                          0x0041e9ca
                                                                                          0x0041e9d1
                                                                                          0x0041e9d6
                                                                                          0x0041e9d6
                                                                                          0x0041e9da
                                                                                          0x0041e9dd
                                                                                          0x0041e9df
                                                                                          0x0041e9e0
                                                                                          0x0041e9e2
                                                                                          0x0041e9e2
                                                                                          0x0041e9f1
                                                                                          0x0041e9fa
                                                                                          0x0041ea00
                                                                                          0x0041ea05
                                                                                          0x0041ea06
                                                                                          0x0041ea06
                                                                                          0x0041e9e2
                                                                                          0x0041ea0e
                                                                                          0x0041ea14
                                                                                          0x0041ea19
                                                                                          0x0041ea20
                                                                                          0x0041ea25
                                                                                          0x0041ea25
                                                                                          0x0041ea27
                                                                                          0x0041ea2e
                                                                                          0x0041ea30
                                                                                          0x0041ea31
                                                                                          0x0041ea34
                                                                                          0x0041ea39
                                                                                          0x0041ea43

                                                                                          APIs
                                                                                          • GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041E870
                                                                                          • EnumCalendarInfoW.KERNEL32(0041E6A4,00000000,00000000,00000004), ref: 0041E87B
                                                                                          • GetThreadLocale.KERNEL32(00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E8B0
                                                                                          • EnumCalendarInfoW.KERNEL32(0041E73C,00000000,00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E8BB
                                                                                          • GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041E94C
                                                                                          • EnumCalendarInfoW.KERNEL32(0041E6A4,00000000,00000000,00000004), ref: 0041E957
                                                                                          • GetThreadLocale.KERNEL32(00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E98E
                                                                                          • EnumCalendarInfoW.KERNEL32(0041E73C,00000000,00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E999
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CalendarEnumInfoLocaleThread
                                                                                          • String ID: B.C.$ToA
                                                                                          • API String ID: 683597275-3246262772
                                                                                          • Opcode ID: 30548e6079ac2033bf0e04708f2267278c7844b43060e3a4cc9a960100252a35
                                                                                          • Instruction ID: 5f9a2d1895d99171d8daf0119b8bb3b5d98f795b9e196a74a36fcd0882631485
                                                                                          • Opcode Fuzzy Hash: 30548e6079ac2033bf0e04708f2267278c7844b43060e3a4cc9a960100252a35
                                                                                          • Instruction Fuzzy Hash: 3061D7786002009FD710EF2BCC85AD677A9FB84354B518A7AFC019B3A6CB78DC41CB99
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040A7E4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E0040A7E4(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t18;
				signed short _t28;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t47;

				_t42 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t44 = __edx;
				_t28 = __eax;
				_push(_t47);
				_push(0x40a8e8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				EnterCriticalSection(0x4bdc10);
				if(_t28 !=  *0x4bdc28) {
					LeaveCriticalSection(0x4bdc10);
					E00407A20(_t44);
					if(IsValidLocale(_t28 & 0x0000ffff, 2) != 0) {
						if( *0x4bdc0c == 0) {
							_t18 = E0040A4CC(_t28, _t28, _t44, __edi, _t44);
							L00403738();
							if(_t28 != _t18) {
								if( *_t44 != 0) {
									_t18 = E004086E4(_t44, E0040A900);
								}
								L00403738();
								E0040A4CC(_t18, _t28,  &_v8, _t42, _t44);
								E004086E4(_t44, _v8);
							}
						} else {
							E0040A6C8(_t28, _t44);
						}
					}
					EnterCriticalSection(0x4bdc10);
					 *0x4bdc28 = _t28;
					E0040A34C(0x4bdc2a, E004084EC( *_t44), 0xaa);
					LeaveCriticalSection(0x4bdc10);
				} else {
					E0040858C(_t44, 0x55, 0x4bdc2a);
					LeaveCriticalSection(0x4bdc10);
				}
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E0040A8EF);
				return E00407A20( &_v8);
			}









                                                                                          0x0040a7e4
                                                                                          0x0040a7e7
                                                                                          0x0040a7e9
                                                                                          0x0040a7ea
                                                                                          0x0040a7eb
                                                                                          0x0040a7ed
                                                                                          0x0040a7f1
                                                                                          0x0040a7f2
                                                                                          0x0040a7f7
                                                                                          0x0040a7fa
                                                                                          0x0040a802
                                                                                          0x0040a80e
                                                                                          0x0040a835
                                                                                          0x0040a83c
                                                                                          0x0040a84e
                                                                                          0x0040a857
                                                                                          0x0040a868
                                                                                          0x0040a86d
                                                                                          0x0040a875
                                                                                          0x0040a87a
                                                                                          0x0040a883
                                                                                          0x0040a883
                                                                                          0x0040a888
                                                                                          0x0040a890
                                                                                          0x0040a89a
                                                                                          0x0040a89a
                                                                                          0x0040a859
                                                                                          0x0040a85d
                                                                                          0x0040a85d
                                                                                          0x0040a857
                                                                                          0x0040a8a4
                                                                                          0x0040a8a9
                                                                                          0x0040a8c3
                                                                                          0x0040a8cd
                                                                                          0x0040a810
                                                                                          0x0040a81c
                                                                                          0x0040a826
                                                                                          0x0040a826
                                                                                          0x0040a8d4
                                                                                          0x0040a8d7
                                                                                          0x0040a8da
                                                                                          0x0040a8e7

                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000,00000000), ref: 0040A802
                                                                                          • LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000), ref: 0040A826
                                                                                          • LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000), ref: 0040A835
                                                                                          • IsValidLocale.KERNEL32(00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A847
                                                                                          • EnterCriticalSection.KERNEL32(004BDC10,00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A8A4
                                                                                          • LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A8CD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Leave$Enter$LocaleValid
                                                                                          • String ID: en-US,en,
                                                                                          • API String ID: 975949045-3579323720
                                                                                          • Opcode ID: e3721d42ea745a9edd8ebaecb4ab5b2828546a05d0e92c0f55165f56426ca85b
                                                                                          • Instruction ID: af4c48ae6f9d4b9345a2e7437780db60bfff4a38cfd5d6d0e3948ff18df55379
                                                                                          • Opcode Fuzzy Hash: e3721d42ea745a9edd8ebaecb4ab5b2828546a05d0e92c0f55165f56426ca85b
                                                                                          • Instruction Fuzzy Hash: 31218461B1031077DA11BB668C03B5E29A89B44705BA0887BB140B32D2EEBD8D52D66F
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042301C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 61%
                                                                                          			E0042301C(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x423116);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					if(E0041FF2C() != 2) {
						if(E00422FF4(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E00422FE8();
							RegCloseKey(_v12);
						}
					} else {
						if(E00422FF4(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E00422FE8();
							RegCloseKey(_v12);
						}
					}
					E0040873C( &_v20, _v8, 0x42322c);
					E00405920(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E0042311D);
				E00407A20( &_v20);
				return E00407A20( &_v8);
			}










                                                                                          0x00423022
                                                                                          0x00423025
                                                                                          0x00423028
                                                                                          0x0042302d
                                                                                          0x0042302e
                                                                                          0x00423033
                                                                                          0x00423036
                                                                                          0x00423049
                                                                                          0x00423050
                                                                                          0x00423063
                                                                                          0x004230b8
                                                                                          0x004230c5
                                                                                          0x004230ce
                                                                                          0x004230ce
                                                                                          0x00423065
                                                                                          0x00423080
                                                                                          0x0042308d
                                                                                          0x00423096
                                                                                          0x00423096
                                                                                          0x00423080
                                                                                          0x004230de
                                                                                          0x004230e9
                                                                                          0x004230f4
                                                                                          0x004230f4
                                                                                          0x00423052
                                                                                          0x00423052
                                                                                          0x00423054
                                                                                          0x004230fa
                                                                                          0x004230fd
                                                                                          0x00423100
                                                                                          0x00423108
                                                                                          0x00423115

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00423116), ref: 00423043
                                                                                            • Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00423116), ref: 00423096
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressCloseHandleModuleProc
                                                                                          • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
                                                                                          • API String ID: 4190037839-2401316094
                                                                                          • Opcode ID: 0c53a133d6644a1b94ef3c959f72937b5652b11bdcaf1ce6cf384129006bdbe5
                                                                                          • Instruction ID: 05790bdd6973bc135d390eb6e5b6569f0703c8ea8b4006eead18837270f0a894
                                                                                          • Opcode Fuzzy Hash: 0c53a133d6644a1b94ef3c959f72937b5652b11bdcaf1ce6cf384129006bdbe5
                                                                                          • Instruction Fuzzy Hash: 39217930B00228ABDB10EEB5DD42A9F73F4EB44345FA04477A500E3281DB7CAB41962D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00406424 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 36%
                                                                                          			E00406424(void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char* _t23;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff4;
				_v16 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_v8 = 0x40;
					goto L11;
				} else {
					_t23 =  &_v16;
					_push(_t23);
					_push(0);
					L00403808();
					if(_t23 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_v12 = E004053F0(_v16);
						_push(_t41);
						_push(E004064D2);
						_push( *[fs:edx]);
						 *[fs:edx] = _t44;
						_push( &_v16);
						_push(_v12);
						L00403808();
						_t29 = _v12;
						if(_v16 <= 0) {
							L8:
							_pop(_t39);
							 *[fs:eax] = _t39;
							_push(E004064D9);
							return E0040540C(_v12);
						} else {
							while( *((short*)(_t29 + 4)) != 2 ||  *((char*)(_t29 + 8)) != 1) {
								_t29 = _t29 + 0x18;
								_v16 = _v16 - 0x18;
								if(_v16 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_v8 =  *(_t29 + 0xa) & 0x0000ffff;
							E00407210();
							L11:
							return _v8;
						}
					}
				}
				L12:
			}












                                                                                          0x00406425
                                                                                          0x00406427
                                                                                          0x0040642c
                                                                                          0x00406446
                                                                                          0x004064d9
                                                                                          0x004064d9
                                                                                          0x00000000
                                                                                          0x0040644c
                                                                                          0x0040644c
                                                                                          0x0040644f
                                                                                          0x00406450
                                                                                          0x00406452
                                                                                          0x00406459
                                                                                          0x00000000
                                                                                          0x00406465
                                                                                          0x0040646d
                                                                                          0x00406472
                                                                                          0x00406473
                                                                                          0x00406478
                                                                                          0x0040647b
                                                                                          0x00406481
                                                                                          0x00406485
                                                                                          0x00406486
                                                                                          0x0040648b
                                                                                          0x00406492
                                                                                          0x004064bc
                                                                                          0x004064be
                                                                                          0x004064c1
                                                                                          0x004064c4
                                                                                          0x004064d1
                                                                                          0x00406494
                                                                                          0x00406494
                                                                                          0x004064af
                                                                                          0x004064b2
                                                                                          0x004064ba
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004064ba
                                                                                          0x004064a5
                                                                                          0x004064a8
                                                                                          0x004064e0
                                                                                          0x004064e6
                                                                                          0x004064e6
                                                                                          0x00406492
                                                                                          0x00406459
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00406439
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040643F
                                                                                          • GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 00406452
                                                                                          • GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 0040645B
                                                                                          • GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,004064D2,?,00000000,?,GetLogicalProcessorInformation), ref: 00406486
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
                                                                                          • String ID: @$GetLogicalProcessorInformation$kernel32.dll
                                                                                          • API String ID: 1184211438-79381301
                                                                                          • Opcode ID: 60cbd49ddd200d6d95d4e054eb85e0ada012a2fb0b751d352b1ba5f8ec496b5f
                                                                                          • Instruction ID: 8f5f9a4eb212fab3c4852abc810e80ead921d34dcce11bc4c58bc7a6251dba94
                                                                                          • Opcode Fuzzy Hash: 60cbd49ddd200d6d95d4e054eb85e0ada012a2fb0b751d352b1ba5f8ec496b5f
                                                                                          • Instruction Fuzzy Hash: 52116371D00208BEDB20EFA5D84576EBBA8EB40705F1184BBF815F32C1D67D9A908B1D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040D218 Relevance: 13.8, APIs: 9, Instructions: 258COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 67%
                                                                                          			E0040D218(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				long _v16;
				void* _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				struct HINSTANCE__** _v48;
				CHAR* _v52;
				void _v56;
				long _v60;
				_Unknown_base(*)()* _v64;
				struct HINSTANCE__* _v68;
				CHAR* _v72;
				signed int _v76;
				CHAR* _v80;
				intOrPtr* _v84;
				void* _v88;
				void _v92;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t142;
				long _t166;
				signed int* _t190;
				_Unknown_base(*)()* _t191;
				void* _t194;
				intOrPtr _t196;

				_push(_a4);
				memcpy( &_v56, 0x4b7c40, 8 << 2);
				_pop(_t194);
				_v56 =  *0x4b7c40;
				_v52 = E0040D6C8( *0x004B7C44);
				_v48 = E0040D6D8( *0x004B7C48);
				_v44 = E0040D6E8( *0x004B7C4C);
				_v40 = E0040D6F8( *0x004B7C50);
				_v36 = E0040D6F8( *0x004B7C54);
				_v32 = E0040D6F8( *0x004B7C58);
				_v28 =  *0x004B7C5C;
				memcpy( &_v92, 0x4b7c60, 9 << 2);
				_t196 = _t194;
				_v88 = 0x4b7c60;
				_v84 = _a8;
				_v80 = _v52;
				if((_v56 & 0x00000001) == 0) {
					_t166 =  *0x4b7c84; // 0x0
					_v8 = _t166;
					_v8 =  &_v92;
					RaiseException(0xc06d0057, 0, 1,  &_v8);
					return 0;
				}
				_t104 = _a8 - _v44;
				_t142 =  *_v48;
				if(_t104 < 0) {
					_t104 = _t104 + 3;
				}
				_v12 = _t104 >> 2;
				_t106 = _v12;
				_t190 = (_t106 << 2) + _v40;
				_t108 = (_t106 & 0xffffff00 | (_t190[0] & 0x00000080) == 0x00000000) & 0x00000001;
				_v76 = _t108;
				if(_t108 == 0) {
					_v72 =  *_t190 & 0x0000ffff;
				} else {
					_v72 = E0040D708( *_t190) + 2;
				}
				_t191 = 0;
				if( *0x4be640 == 0) {
					L10:
					if(_t142 != 0) {
						L25:
						_v68 = _t142;
						if( *0x4be640 != 0) {
							_t191 =  *0x4be640(2,  &_v92);
						}
						if(_t191 != 0) {
							L36:
							if(_t191 == 0) {
								_v60 = GetLastError();
								if( *0x4be644 != 0) {
									_t191 =  *0x4be644(4,  &_v92);
								}
								if(_t191 == 0) {
									_t113 =  *0x4b7c8c; // 0x0
									_v24 = _t113;
									_v24 =  &_v92;
									RaiseException(0xc06d007f, 0, 1,  &_v24);
									_t191 = _v64;
								}
							}
							goto L41;
						} else {
							if( *((intOrPtr*)(_t196 + 0x14)) == 0 ||  *((intOrPtr*)(_t196 + 0x1c)) == 0) {
								L35:
								_t191 = GetProcAddress(_t142, _v72);
								goto L36;
							} else {
								_t119 =  *((intOrPtr*)(_t142 + 0x3c)) + _t142;
								if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) != _v28 || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t142) & 0x00000001) == 0) {
									goto L35;
								} else {
									_t191 =  *((intOrPtr*)(_v36 + _v12 * 4));
									if(_t191 == 0) {
										goto L35;
									}
									L41:
									 *_a8 = _t191;
									goto L42;
								}
							}
						}
					}
					if( *0x4be640 != 0) {
						_t142 =  *0x4be640(1,  &_v92);
					}
					if(_t142 == 0) {
						_t142 = LoadLibraryA(_v80);
					}
					if(_t142 != 0) {
						L20:
						if(_t142 == E0040CBA0(_v48, _t142)) {
							FreeLibrary(_t142);
						} else {
							if( *((intOrPtr*)(_t196 + 0x18)) != 0) {
								_t124 = LocalAlloc(0x40, 8);
								_v20 = _t124;
								if(_t124 != 0) {
									 *((intOrPtr*)(_v20 + 4)) = _t196;
									_t126 =  *0x4b7c3c; // 0x7600e0
									 *_v20 = _t126;
									 *0x4b7c3c = _v20;
								}
							}
						}
						goto L25;
					} else {
						_v60 = GetLastError();
						if( *0x4be644 != 0) {
							_t142 =  *0x4be644(3,  &_v92);
						}
						if(_t142 != 0) {
							goto L20;
						} else {
							_t128 =  *0x4b7c88; // 0x0
							_v16 = _t128;
							_v16 =  &_v92;
							RaiseException(0xc06d007e, 0, 1,  &_v16);
							return _v64;
						}
					}
				} else {
					_t191 =  *0x4be640(0,  &_v92);
					if(_t191 == 0) {
						goto L10;
					} else {
						L42:
						if( *0x4be640 != 0) {
							_v60 = 0;
							_v68 = _t142;
							_v64 = _t191;
							 *0x4be640(5,  &_v92);
						}
						return _t191;
					}
				}
			}







































                                                                                          0x0040d22c
                                                                                          0x0040d232
                                                                                          0x0040d234
                                                                                          0x0040d237
                                                                                          0x0040d244
                                                                                          0x0040d251
                                                                                          0x0040d25e
                                                                                          0x0040d26b
                                                                                          0x0040d278
                                                                                          0x0040d285
                                                                                          0x0040d28e
                                                                                          0x0040d29c
                                                                                          0x0040d29e
                                                                                          0x0040d29f
                                                                                          0x0040d2a5
                                                                                          0x0040d2ab
                                                                                          0x0040d2b2
                                                                                          0x0040d2b4
                                                                                          0x0040d2ba
                                                                                          0x0040d2c0
                                                                                          0x0040d2d0
                                                                                          0x00000000
                                                                                          0x0040d2d5
                                                                                          0x0040d2e2
                                                                                          0x0040d2e7
                                                                                          0x0040d2e9
                                                                                          0x0040d2eb
                                                                                          0x0040d2eb
                                                                                          0x0040d2f1
                                                                                          0x0040d2f4
                                                                                          0x0040d2fc
                                                                                          0x0040d306
                                                                                          0x0040d309
                                                                                          0x0040d30e
                                                                                          0x0040d329
                                                                                          0x0040d310
                                                                                          0x0040d31c
                                                                                          0x0040d31c
                                                                                          0x0040d32c
                                                                                          0x0040d335
                                                                                          0x0040d34e
                                                                                          0x0040d350
                                                                                          0x0040d412
                                                                                          0x0040d412
                                                                                          0x0040d41c
                                                                                          0x0040d42a
                                                                                          0x0040d42a
                                                                                          0x0040d42e
                                                                                          0x0040d47b
                                                                                          0x0040d47d
                                                                                          0x0040d484
                                                                                          0x0040d48e
                                                                                          0x0040d49c
                                                                                          0x0040d49c
                                                                                          0x0040d4a0
                                                                                          0x0040d4a2
                                                                                          0x0040d4a7
                                                                                          0x0040d4ad
                                                                                          0x0040d4bd
                                                                                          0x0040d4c2
                                                                                          0x0040d4c2
                                                                                          0x0040d4a0
                                                                                          0x00000000
                                                                                          0x0040d430
                                                                                          0x0040d434
                                                                                          0x0040d46f
                                                                                          0x0040d479
                                                                                          0x00000000
                                                                                          0x0040d43c
                                                                                          0x0040d43f
                                                                                          0x0040d447
                                                                                          0x00000000
                                                                                          0x0040d460
                                                                                          0x0040d466
                                                                                          0x0040d46b
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040d4c5
                                                                                          0x0040d4c8
                                                                                          0x00000000
                                                                                          0x0040d4c8
                                                                                          0x0040d447
                                                                                          0x0040d434
                                                                                          0x0040d42e
                                                                                          0x0040d35d
                                                                                          0x0040d36b
                                                                                          0x0040d36b
                                                                                          0x0040d36f
                                                                                          0x0040d37a
                                                                                          0x0040d37a
                                                                                          0x0040d37e
                                                                                          0x0040d3cb
                                                                                          0x0040d3d7
                                                                                          0x0040d40d
                                                                                          0x0040d3d9
                                                                                          0x0040d3dd
                                                                                          0x0040d3e3
                                                                                          0x0040d3e8
                                                                                          0x0040d3ed
                                                                                          0x0040d3f4
                                                                                          0x0040d3fa
                                                                                          0x0040d3ff
                                                                                          0x0040d404
                                                                                          0x0040d404
                                                                                          0x0040d3ed
                                                                                          0x0040d3dd
                                                                                          0x00000000
                                                                                          0x0040d380
                                                                                          0x0040d385
                                                                                          0x0040d38f
                                                                                          0x0040d39d
                                                                                          0x0040d39d
                                                                                          0x0040d3a1
                                                                                          0x00000000
                                                                                          0x0040d3a3
                                                                                          0x0040d3a3
                                                                                          0x0040d3a8
                                                                                          0x0040d3ae
                                                                                          0x0040d3be
                                                                                          0x00000000
                                                                                          0x0040d3c3
                                                                                          0x0040d3a1
                                                                                          0x0040d337
                                                                                          0x0040d343
                                                                                          0x0040d347
                                                                                          0x00000000
                                                                                          0x0040d349
                                                                                          0x0040d4ca
                                                                                          0x0040d4d1
                                                                                          0x0040d4d5
                                                                                          0x0040d4d8
                                                                                          0x0040d4db
                                                                                          0x0040d4e4
                                                                                          0x0040d4e4
                                                                                          0x00000000
                                                                                          0x0040d4ea
                                                                                          0x0040d347

                                                                                          APIs
                                                                                          • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040D2D0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExceptionRaise
                                                                                          • String ID:
                                                                                          • API String ID: 3997070919-0
                                                                                          • Opcode ID: 4fdbadfbff537c598349848257c7330453a14fb024132e1a583ffc8385a63ee1
                                                                                          • Instruction ID: 6bdc8742f8c12d3c05e6aa795b4e0fa0c425ed74332de7fca684440f38d882f1
                                                                                          • Opcode Fuzzy Hash: 4fdbadfbff537c598349848257c7330453a14fb024132e1a583ffc8385a63ee1
                                                                                          • Instruction Fuzzy Hash: 7CA16F75D002089FDB14DFE9D881BAEB7B5BB88300F14423AE505B73C1DB78A949CB59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004047B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 72%
                                                                                          			E004047B0(int __eax, void* __ecx, void* __edx) {
				long _v12;
				int _t4;
				long _t7;
				void* _t11;
				long _t12;
				void* _t13;
				long _t18;

				_t4 = __eax;
				_t24 = __edx;
				_t20 = __eax;
				if( *0x4bb058 == 0) {
					_push(0x2010);
					_push(__edx);
					_push(__eax);
					_push(0);
					L00403780();
				} else {
					_t7 = E00407EF0(__edx);
					WriteFile(GetStdHandle(0xfffffff4), _t24, _t7,  &_v12, 0);
					_t11 =  *0x4b7078; // 0x403920
					_t12 = E00407EF0(_t11);
					_t13 =  *0x4b7078; // 0x403920
					WriteFile(GetStdHandle(0xfffffff4), _t13, _t12,  &_v12, 0);
					_t18 = E00407EF0(_t20);
					_t4 = WriteFile(GetStdHandle(0xfffffff4), _t20, _t18,  &_v12, 0);
				}
				return _t4;
			}










                                                                                          0x004047b0
                                                                                          0x004047b3
                                                                                          0x004047b5
                                                                                          0x004047be
                                                                                          0x00404821
                                                                                          0x00404826
                                                                                          0x00404827
                                                                                          0x00404828
                                                                                          0x0040482a
                                                                                          0x004047c0
                                                                                          0x004047c9
                                                                                          0x004047d8
                                                                                          0x004047e4
                                                                                          0x004047e9
                                                                                          0x004047ef
                                                                                          0x004047fd
                                                                                          0x0040480b
                                                                                          0x0040481a
                                                                                          0x0040481a
                                                                                          0x00404832

                                                                                          APIs
                                                                                          • GetStdHandle.KERNEL32(000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D2
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D8
                                                                                          • GetStdHandle.KERNEL32(000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047F7
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047FD
                                                                                          • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?), ref: 00404814
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000), ref: 0040481A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite
                                                                                          • String ID: 9@
                                                                                          • API String ID: 3320372497-3209974744
                                                                                          • Opcode ID: 5f8d133322f34133c732956f1222a9d0eafcb790ac979970e9ef56a2ae19cd1b
                                                                                          • Instruction ID: 9b3b4e35e49a927b8991458b20a1a8ec0ccf5b925403b1971dfbe1b0899ab5f0
                                                                                          • Opcode Fuzzy Hash: 5f8d133322f34133c732956f1222a9d0eafcb790ac979970e9ef56a2ae19cd1b
                                                                                          • Instruction Fuzzy Hash: 2001AEE25492103DE110F7A69C85F57168C8B4472AF10467F7218F35D2C9395D44927E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041F0F4 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 64%
                                                                                          			E0041F0F4(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x41f219);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E0041EEFC(_t15, __ebx,  &_v2188, __edx, __edi, __esi, 0x400);
				_t17 =  *0x4ba6c0; // 0x4bb058
				if( *_t17 == 0) {
					_t19 =  *0x4ba4f8; // 0x40e710
					_t11 = _t19 + 4; // 0xffed
					_t21 =  *0x4be634; // 0x400000
					LoadStringW(E00409FF0(_t21),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x4ba524; // 0x4bb340
					E00405564(E00405820(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E00409C00();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x41f234, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41f220);
				_t57 =  *0x41f0c4; // 0x41f0c8
				return E00409D24( &_v8, _t57);
			}

















                                                                                          0x0041f0fd
                                                                                          0x0041f0fe
                                                                                          0x0041f101
                                                                                          0x0041f106
                                                                                          0x0041f107
                                                                                          0x0041f10c
                                                                                          0x0041f10f
                                                                                          0x0041f122
                                                                                          0x0041f124
                                                                                          0x0041f12c
                                                                                          0x0041f1ca
                                                                                          0x0041f1cf
                                                                                          0x0041f1d3
                                                                                          0x0041f1de
                                                                                          0x0041f1f8
                                                                                          0x0041f132
                                                                                          0x0041f132
                                                                                          0x0041f13c
                                                                                          0x0041f15a
                                                                                          0x0041f15c
                                                                                          0x0041f16b
                                                                                          0x0041f188
                                                                                          0x0041f1a0
                                                                                          0x0041f1ba
                                                                                          0x0041f1ba
                                                                                          0x0041f1ff
                                                                                          0x0041f202
                                                                                          0x0041f205
                                                                                          0x0041f20d
                                                                                          0x0041f218

                                                                                          APIs
                                                                                            • Part of subcall function 0041EEFC: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F0A8), ref: 0041EF2F
                                                                                            • Part of subcall function 0041EEFC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF53
                                                                                            • Part of subcall function 0041EEFC: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041EF6E
                                                                                            • Part of subcall function 0041EEFC: LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F009
                                                                                          • WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041F219), ref: 0041F155
                                                                                          • WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F188
                                                                                          • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F19A
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F1A0
                                                                                          • GetStdHandle.KERNEL32(000000F4,0041F234,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041F1B4
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,0041F234,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041F1BA
                                                                                          • LoadStringW.USER32(00000000,0000FFED,?,00000040), ref: 0041F1DE
                                                                                          • MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041F1F8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 135118572-0
                                                                                          • Opcode ID: 7bf27a680bd44ec5315003c7bd75f7b580991028cc1534cfff61cb99441fed85
                                                                                          • Instruction ID: 441773961034998e17761d3334fa1b60ae8bad0ad03d42d5622a75f3c8f76c28
                                                                                          • Opcode Fuzzy Hash: 7bf27a680bd44ec5315003c7bd75f7b580991028cc1534cfff61cb99441fed85
                                                                                          • Instruction Fuzzy Hash: 7D31CF75640204BFE714E796CC42FDA77ACEB08704F9044BABA04F71D2DA786E548B6D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00404464 Relevance: 10.9, APIs: 7, Instructions: 406COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00404464(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t192;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t205;
				unsigned int _t207;
				intOrPtr _t213;
				void* _t225;
				intOrPtr _t227;
				void* _t228;
				signed int _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t241;
				void* _t243;
				intOrPtr* _t244;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t217 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t217);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t225);
							_t244 = _t243 + 0xffffffe0;
							_t218 = __edx;
							_t202 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00403EE8(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t218 - 0x40a2c;
										if(_t218 > 0x40a2c) {
											_t78 = _t202 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t218;
										}
										E00403AA4(_t202, _t218, _t150);
										E0040426C(_t202, _t202, _t225);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t227 = __edx;
								} else {
									_t227 = 0xbadb9d;
								}
								 *_t244 = _t202 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t244 + 8), _t244 + 8, 0x1c);
								if( *((intOrPtr*)(_t244 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00403EE8(_t227);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t227 - 0x40a2c;
										if(_t227 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t218;
										}
										E00403A74(_t202,  *((intOrPtr*)(_t202 - 0x10 + 8)), _t150);
										E0040426C(_t202, _t202, _t227);
									}
								} else {
									 *(_t244 + 0x10) =  *(_t244 + 0x10) & 0xffff0000;
									_t94 =  *(_t244 + 0x10);
									if(_t218 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t227 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t244 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t244 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t202 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t218;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t202;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t205 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t225);
						if(__edx > _t171) {
							_t102 =  *(_t205 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t228 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t207 = _t171;
								_t109 = E00403EE8(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t192 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t228 - 0x40a2c;
									if(_t228 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t192;
									}
									_t230 = _t109;
									E00403A74(_t217, _t207, _t109);
									E0040426C(_t217, _t207, _t230);
									return _t230;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t232 = _t171 + _t115;
								__eflags = __edx - _t232;
								if(__edx > _t232) {
									goto L75;
								} else {
									__eflags =  *0x4bb059;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E00403AC0(_t205);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t195 = _t232 + 4 - _t123;
										__eflags = _t195;
										if(_t195 > 0) {
											 *(_t217 + _t232 - 4) = _t195;
											 *((intOrPtr*)(_t217 - 4 + _t123)) = _t195 + 3;
											_t233 = _t123;
											__eflags = _t195 - 0xb30;
											if(_t195 >= 0xb30) {
												__eflags = _t123 + _t217;
												E00403B00(_t123 + _t217, _t171, _t195);
											}
										} else {
											 *(_t217 + _t232) =  *(_t217 + _t232) & 0xfffffff7;
											_t233 = _t232 + 4;
										}
										_t234 = _t233 | _t156;
										__eflags = _t234;
										 *(_t217 - 4) = _t234;
										 *0x4bbae8 = 0;
										_t109 = _t217;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x4bbae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4bb989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x4bbae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										_t129 =  *(_t205 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x4bbae8 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t232 = _t171 + _t115;
											__eflags = _t176 - _t232;
											if(_t176 > _t232) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t238 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t238;
									__eflags =  *0x4bb059;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x4bbae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4bb989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x4bbae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										__eflags = 0xf;
									}
									 *(_t217 - 4) = _t156 | _t238;
									_t161 = _t174;
									_t196 =  *(_t205 - 4);
									__eflags = _t196 & 0x00000001;
									if((_t196 & 0x00000001) != 0) {
										_t131 = _t205;
										_t197 = _t196 & 0xfffffff0;
										_t161 = _t161 + _t197;
										_t205 = _t205 + _t197;
										__eflags = _t197 - 0xb30;
										if(_t197 >= 0xb30) {
											E00403AC0(_t131);
										}
									} else {
										 *(_t205 - 4) = _t196 | 0x00000008;
									}
									 *((intOrPtr*)(_t205 - 8)) = _t161;
									 *((intOrPtr*)(_t217 + _t238 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00403B00(_t217 + _t238, _t174, _t161);
									}
									 *0x4bbae8 = 0;
									return _t217;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t213 = __edx;
										_t140 = E00403EE8(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t241 = _t140;
											E00403AA4(_t217, _t213, _t140);
											E0040426C(_t217, _t213, _t241);
											_t140 = _t241;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00403EE8((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E0040426C(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00403EE8(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E0040426C(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}












































                                                                                          0x00404464
                                                                                          0x00404464
                                                                                          0x00404464
                                                                                          0x0040446c
                                                                                          0x0040446e
                                                                                          0x004044fc
                                                                                          0x004044ff
                                                                                          0x0040476c
                                                                                          0x0040476d
                                                                                          0x0040476e
                                                                                          0x00404771
                                                                                          0x00403d9c
                                                                                          0x00403d9d
                                                                                          0x00403d9e
                                                                                          0x00403d9f
                                                                                          0x00403da0
                                                                                          0x00403da3
                                                                                          0x00403da5
                                                                                          0x00403dac
                                                                                          0x00403db5
                                                                                          0x00403dba
                                                                                          0x00403ea1
                                                                                          0x00403ea3
                                                                                          0x00403eb6
                                                                                          0x00403eb8
                                                                                          0x00403eba
                                                                                          0x00403ebc
                                                                                          0x00403ec2
                                                                                          0x00403ec6
                                                                                          0x00403ec6
                                                                                          0x00403ec9
                                                                                          0x00403ec9
                                                                                          0x00403ed2
                                                                                          0x00403ed9
                                                                                          0x00403ed9
                                                                                          0x00403ea5
                                                                                          0x00403ea5
                                                                                          0x00403eaa
                                                                                          0x00403eaa
                                                                                          0x00403dc0
                                                                                          0x00403dc9
                                                                                          0x00403dcf
                                                                                          0x00403dcb
                                                                                          0x00403dcb
                                                                                          0x00403dcb
                                                                                          0x00403ddb
                                                                                          0x00403dea
                                                                                          0x00403df7
                                                                                          0x00403e67
                                                                                          0x00403e6e
                                                                                          0x00403e70
                                                                                          0x00403e72
                                                                                          0x00403e74
                                                                                          0x00403e7a
                                                                                          0x00403e7e
                                                                                          0x00403e7e
                                                                                          0x00403e81
                                                                                          0x00403e81
                                                                                          0x00403e91
                                                                                          0x00403e98
                                                                                          0x00403e98
                                                                                          0x00403df9
                                                                                          0x00403df9
                                                                                          0x00403e05
                                                                                          0x00403e0b
                                                                                          0x00000000
                                                                                          0x00403e0d
                                                                                          0x00403e1e
                                                                                          0x00403e22
                                                                                          0x00403e24
                                                                                          0x00403e24
                                                                                          0x00403e3a
                                                                                          0x00000000
                                                                                          0x00403e52
                                                                                          0x00403e54
                                                                                          0x00403e57
                                                                                          0x00403e60
                                                                                          0x00403e63
                                                                                          0x00403e63
                                                                                          0x00403e3a
                                                                                          0x00403e0b
                                                                                          0x00403df7
                                                                                          0x00403ee7
                                                                                          0x00404777
                                                                                          0x00404777
                                                                                          0x00404779
                                                                                          0x00404779
                                                                                          0x00404505
                                                                                          0x00404507
                                                                                          0x0040450a
                                                                                          0x0040450b
                                                                                          0x0040450e
                                                                                          0x00404511
                                                                                          0x00404514
                                                                                          0x00404516
                                                                                          0x00404517
                                                                                          0x0040462c
                                                                                          0x0040462f
                                                                                          0x00404631
                                                                                          0x00404724
                                                                                          0x0040472f
                                                                                          0x00404736
                                                                                          0x00404738
                                                                                          0x0040473b
                                                                                          0x00404740
                                                                                          0x00404741
                                                                                          0x00404743
                                                                                          0x00000000
                                                                                          0x00404745
                                                                                          0x00404745
                                                                                          0x0040474b
                                                                                          0x0040474d
                                                                                          0x0040474d
                                                                                          0x00404750
                                                                                          0x00404758
                                                                                          0x0040475f
                                                                                          0x0040476a
                                                                                          0x0040476a
                                                                                          0x00404637
                                                                                          0x00404637
                                                                                          0x0040463a
                                                                                          0x0040463d
                                                                                          0x0040463f
                                                                                          0x00000000
                                                                                          0x00404645
                                                                                          0x00404645
                                                                                          0x0040464c
                                                                                          0x004046a9
                                                                                          0x004046a9
                                                                                          0x004046ae
                                                                                          0x004046b4
                                                                                          0x004046b9
                                                                                          0x004046ba
                                                                                          0x004046ba
                                                                                          0x004046c6
                                                                                          0x004046d7
                                                                                          0x004046dd
                                                                                          0x004046dd
                                                                                          0x004046df
                                                                                          0x004046ec
                                                                                          0x004046f3
                                                                                          0x004046f7
                                                                                          0x004046f9
                                                                                          0x004046ff
                                                                                          0x00404701
                                                                                          0x00404703
                                                                                          0x00404703
                                                                                          0x004046e1
                                                                                          0x004046e1
                                                                                          0x004046e5
                                                                                          0x004046e5
                                                                                          0x00404708
                                                                                          0x00404708
                                                                                          0x0040470a
                                                                                          0x0040470d
                                                                                          0x00404714
                                                                                          0x00404716
                                                                                          0x0040471a
                                                                                          0x0040464e
                                                                                          0x0040464e
                                                                                          0x00404653
                                                                                          0x0040465b
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040465d
                                                                                          0x0040465f
                                                                                          0x00404666
                                                                                          0x00000000
                                                                                          0x00404668
                                                                                          0x0040466c
                                                                                          0x00404671
                                                                                          0x00404672
                                                                                          0x00404678
                                                                                          0x00404680
                                                                                          0x00404686
                                                                                          0x0040468b
                                                                                          0x0040468c
                                                                                          0x00000000
                                                                                          0x0040468c
                                                                                          0x00404680
                                                                                          0x00000000
                                                                                          0x00404666
                                                                                          0x00404695
                                                                                          0x00404698
                                                                                          0x0040469b
                                                                                          0x0040469d
                                                                                          0x0040471d
                                                                                          0x0040471d
                                                                                          0x00000000
                                                                                          0x0040469f
                                                                                          0x0040469f
                                                                                          0x004046a2
                                                                                          0x004046a5
                                                                                          0x004046a7
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004046a7
                                                                                          0x0040469d
                                                                                          0x0040464c
                                                                                          0x0040463f
                                                                                          0x0040451d
                                                                                          0x00404520
                                                                                          0x00404522
                                                                                          0x0040452c
                                                                                          0x00404532
                                                                                          0x00404549
                                                                                          0x00404549
                                                                                          0x00404555
                                                                                          0x0040455b
                                                                                          0x0040455d
                                                                                          0x00404564
                                                                                          0x00404566
                                                                                          0x0040456b
                                                                                          0x00404573
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00404575
                                                                                          0x00404577
                                                                                          0x0040457e
                                                                                          0x00000000
                                                                                          0x00404580
                                                                                          0x00404583
                                                                                          0x00404588
                                                                                          0x0040458e
                                                                                          0x00404596
                                                                                          0x0040459b
                                                                                          0x004045a0
                                                                                          0x00000000
                                                                                          0x004045a0
                                                                                          0x00404596
                                                                                          0x00000000
                                                                                          0x0040457e
                                                                                          0x004045a9
                                                                                          0x004045a9
                                                                                          0x004045a9
                                                                                          0x004045ae
                                                                                          0x004045b1
                                                                                          0x004045b3
                                                                                          0x004045b6
                                                                                          0x004045b9
                                                                                          0x004045c4
                                                                                          0x004045c6
                                                                                          0x004045c9
                                                                                          0x004045cb
                                                                                          0x004045cd
                                                                                          0x004045d3
                                                                                          0x004045d5
                                                                                          0x004045d5
                                                                                          0x004045bb
                                                                                          0x004045be
                                                                                          0x004045be
                                                                                          0x004045da
                                                                                          0x004045e0
                                                                                          0x004045e4
                                                                                          0x004045ea
                                                                                          0x004045f1
                                                                                          0x004045f1
                                                                                          0x004045f6
                                                                                          0x00404603
                                                                                          0x00404534
                                                                                          0x00404534
                                                                                          0x0040453a
                                                                                          0x00404604
                                                                                          0x00404608
                                                                                          0x0040460d
                                                                                          0x0040460f
                                                                                          0x00404611
                                                                                          0x00404619
                                                                                          0x00404620
                                                                                          0x00404625
                                                                                          0x00404625
                                                                                          0x0040462b
                                                                                          0x00404540
                                                                                          0x00404540
                                                                                          0x00404545
                                                                                          0x00404547
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00404547
                                                                                          0x0040453a
                                                                                          0x00404524
                                                                                          0x00404524
                                                                                          0x00404528
                                                                                          0x00404528
                                                                                          0x00404522
                                                                                          0x00404517
                                                                                          0x00404474
                                                                                          0x00404474
                                                                                          0x00404476
                                                                                          0x0040447a
                                                                                          0x0040447d
                                                                                          0x0040447f
                                                                                          0x004044b8
                                                                                          0x004044bc
                                                                                          0x004044bd
                                                                                          0x004044bf
                                                                                          0x004044c1
                                                                                          0x004044c3
                                                                                          0x004044c6
                                                                                          0x004044c8
                                                                                          0x004044ca
                                                                                          0x004044cf
                                                                                          0x004044d1
                                                                                          0x004044d3
                                                                                          0x004044d9
                                                                                          0x004044db
                                                                                          0x004044db
                                                                                          0x004044e2
                                                                                          0x004044e2
                                                                                          0x004044e5
                                                                                          0x004044e7
                                                                                          0x004044f0
                                                                                          0x004044f5
                                                                                          0x004044f5
                                                                                          0x004044f7
                                                                                          0x004044f8
                                                                                          0x004044f9
                                                                                          0x004044fa
                                                                                          0x00404481
                                                                                          0x00404481
                                                                                          0x00404488
                                                                                          0x0040448a
                                                                                          0x00404490
                                                                                          0x00404492
                                                                                          0x00404494
                                                                                          0x00404499
                                                                                          0x0040449b
                                                                                          0x0040449d
                                                                                          0x0040449f
                                                                                          0x004044a1
                                                                                          0x004044ac
                                                                                          0x004044b1
                                                                                          0x004044b1
                                                                                          0x004044b3
                                                                                          0x004044b4
                                                                                          0x004044b5
                                                                                          0x0040448c
                                                                                          0x0040448c
                                                                                          0x0040448d
                                                                                          0x0040448e
                                                                                          0x0040448e
                                                                                          0x0040448a
                                                                                          0x0040447f

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ec1625ffc2fe51f8c31513aba64e24c59fd6eccf0fed4d7fd9cb209259156b9f
                                                                                          • Instruction ID: a6f3f7862a5743fd60f07ae337b35688b7a953487e66f12862dc3ba09d14b1d9
                                                                                          • Opcode Fuzzy Hash: ec1625ffc2fe51f8c31513aba64e24c59fd6eccf0fed4d7fd9cb209259156b9f
                                                                                          • Instruction Fuzzy Hash: 8CC115A27106000BD714AE7DDD8476AB68A9BC5716F28827FF244EB3D6DB7CCD418388
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041F7A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 68%
                                                                                          			E0041F7A0(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				short _v558;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				void* _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				char _v620;
				char _v624;
				void* _v628;
				char _v632;
				void* _t64;
				intOrPtr _t65;
				long _t76;
				intOrPtr _t82;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t115;
				intOrPtr _t127;
				void* _t136;
				intOrPtr _t138;
				void* _t141;
				void* _t143;

				_t136 = __edi;
				_t140 = _t141;
				_v632 = 0;
				_v596 = 0;
				_v604 = 0;
				_v600 = 0;
				_v8 = 0;
				_push(_t141);
				_push(0x41f9a6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141 + 0xfffffd8c;
				_t64 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x14)) - 1;
				_t143 = _t64;
				if(_t143 < 0) {
					_t65 =  *0x4ba798; // 0x40e730
					E0040C9F0(_t65,  &_v8, _t140);
				} else {
					if(_t143 == 0) {
						_t107 =  *0x4ba670; // 0x40e738
						E0040C9F0(_t107,  &_v8, _t140);
					} else {
						if(_t64 == 7) {
							_t110 =  *0x4ba4d0; // 0x40e740
							E0040C9F0(_t110,  &_v8, _t140);
						} else {
							_t112 =  *0x4ba5c8; // 0x40e748
							E0040C9F0(_t112,  &_v8, _t140);
						}
					}
				}
				_t115 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x18));
				VirtualQuery( *( *((intOrPtr*)(_a4 - 4)) + 0xc),  &_v36, 0x1c);
				_t138 = _v36.State;
				if(_t138 == 0x1000 || _t138 == 0x10000) {
					_t76 = GetModuleFileNameW(_v36.AllocationBase,  &_v558, 0x105);
					_t147 = _t76;
					if(_t76 == 0) {
						goto L12;
					} else {
						_v592 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
						_v588 = 5;
						E0040858C( &_v600, 0x105,  &_v558);
						E0041A418(_v600, _t115,  &_v596, _t136, _t138, _t147);
						_v584 = _v596;
						_v580 = 0x11;
						_v576 = _v8;
						_v572 = 0x11;
						_v568 = _t115;
						_v564 = 5;
						_push( &_v592);
						_t103 =  *0x4ba6e0; // 0x40e810
						E0040C9F0(_t103,  &_v604, _t140, 3);
						E0041F2A0(_t115, _v604, 1, _t136, _t138);
					}
				} else {
					L12:
					_v628 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
					_v624 = 5;
					_v620 = _v8;
					_v616 = 0x11;
					_v612 = _t115;
					_v608 = 5;
					_push( &_v628);
					_t82 =  *0x4ba67c; // 0x40e6d8
					E0040C9F0(_t82,  &_v632, _t140, 2);
					E0041F2A0(_t115, _v632, 1, _t136, _t138);
				}
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(0x41f9ad);
				E00407A20( &_v632);
				E00407A80( &_v604, 3);
				return E00407A20( &_v8);
			}






































                                                                                          0x0041f7a0
                                                                                          0x0041f7a1
                                                                                          0x0041f7ad
                                                                                          0x0041f7b3
                                                                                          0x0041f7b9
                                                                                          0x0041f7bf
                                                                                          0x0041f7c5
                                                                                          0x0041f7ca
                                                                                          0x0041f7cb
                                                                                          0x0041f7d0
                                                                                          0x0041f7d3
                                                                                          0x0041f7df
                                                                                          0x0041f7df
                                                                                          0x0041f7e2
                                                                                          0x0041f7f0
                                                                                          0x0041f7f5
                                                                                          0x0041f7e4
                                                                                          0x0041f7e4
                                                                                          0x0041f7ff
                                                                                          0x0041f804
                                                                                          0x0041f7e6
                                                                                          0x0041f7e9
                                                                                          0x0041f80e
                                                                                          0x0041f813
                                                                                          0x0041f7eb
                                                                                          0x0041f81d
                                                                                          0x0041f822
                                                                                          0x0041f822
                                                                                          0x0041f7e9
                                                                                          0x0041f7e4
                                                                                          0x0041f82d
                                                                                          0x0041f840
                                                                                          0x0041f845
                                                                                          0x0041f84e
                                                                                          0x0041f86c
                                                                                          0x0041f871
                                                                                          0x0041f873
                                                                                          0x00000000
                                                                                          0x0041f879
                                                                                          0x0041f882
                                                                                          0x0041f888
                                                                                          0x0041f8a0
                                                                                          0x0041f8b1
                                                                                          0x0041f8bc
                                                                                          0x0041f8c2
                                                                                          0x0041f8cc
                                                                                          0x0041f8d2
                                                                                          0x0041f8d9
                                                                                          0x0041f8df
                                                                                          0x0041f8ec
                                                                                          0x0041f8f5
                                                                                          0x0041f8fa
                                                                                          0x0041f90c
                                                                                          0x0041f911
                                                                                          0x0041f915
                                                                                          0x0041f915
                                                                                          0x0041f91e
                                                                                          0x0041f924
                                                                                          0x0041f92e
                                                                                          0x0041f934
                                                                                          0x0041f93b
                                                                                          0x0041f941
                                                                                          0x0041f94e
                                                                                          0x0041f957
                                                                                          0x0041f95c
                                                                                          0x0041f96e
                                                                                          0x0041f973
                                                                                          0x0041f977
                                                                                          0x0041f97a
                                                                                          0x0041f97d
                                                                                          0x0041f988
                                                                                          0x0041f998
                                                                                          0x0041f9a5

                                                                                          APIs
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F9A6), ref: 0041F840
                                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0041F9A6), ref: 0041F86C
                                                                                            • Part of subcall function 0040C9F0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040CA35
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileLoadModuleNameQueryStringVirtual
                                                                                          • String ID: 0@$8@$@@$H@
                                                                                          • API String ID: 902310565-4161625419
                                                                                          • Opcode ID: 2bcb5d97eafe9ae16bdb5e5d20f221eb3d58e794d65a866e62d276be447e8c2a
                                                                                          • Instruction ID: bbc3c026f35d1d6bea3ad9012fddeafd4c483e803022796d8e8ef386e34d3195
                                                                                          • Opcode Fuzzy Hash: 2bcb5d97eafe9ae16bdb5e5d20f221eb3d58e794d65a866e62d276be447e8c2a
                                                                                          • Instruction Fuzzy Hash: 69511874A04258DFCB10EF69CC89BCDB7F4AB48304F0042E6A808A7351D778AE85CF59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00406688 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00406688(signed char* __eax, void* __edx, void* __eflags) {
				void* _t49;
				signed char _t56;
				intOrPtr _t57;
				signed char _t59;
				void* _t70;
				signed char* _t71;
				intOrPtr _t72;
				signed char* _t73;

				_t70 = __edx;
				_t71 = __eax;
				_t72 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t73 = E00406B30(_t71);
					if( *_t73 != 0 || _t70 == 0) {
						break;
					}
					_t73[1] = 0;
					if(_t72 <= 0) {
						while(1) {
							L17:
							_t56 =  *_t71;
							if(_t56 == 0) {
								goto L1;
							}
							asm("lock cmpxchg [esi], edx");
							if(_t56 != _t56) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t73[4] = GetTickCount();
								E0040688C(_t71);
								_t57 =  *0x4bb8f8; // 0x4b9284
								 *((intOrPtr*)(_t57 + 0x10))();
								 *_t73 = 0 == 0;
								if(_t70 != 0xffffffff) {
									_t73[8] = GetTickCount();
									if(_t70 <= _t73[8] - _t73[4]) {
										_t70 = 0;
									} else {
										_t70 = _t70 - _t73[8] - _t73[4];
									}
								}
								if( *_t73 == 0) {
									do {
										asm("lock cmpxchg [esi], edx");
									} while ( *_t71 !=  *_t71);
									_t73[1] = 1;
								} else {
									while(1) {
										_t59 =  *_t71;
										if((_t59 & 0x00000001) != 0) {
											goto L29;
										}
										asm("lock cmpxchg [esi], edx");
										if(_t59 != _t59) {
											continue;
										}
										_t73[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t73[1] == 0);
							if( *_t73 != 0) {
								_t71[8] = GetCurrentThreadId();
								_t71[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t73[4] = GetTickCount();
					_t73[0xc] = 0;
					if(_t72 <= 0) {
						L13:
						if(_t70 == 0xffffffff) {
							goto L17;
						}
						_t73[8] = GetTickCount();
						_t49 = _t73[8] - _t73[4];
						if(_t70 > _t49) {
							_t70 = _t70 - _t49;
							goto L17;
						}
						 *_t73 = 0;
						break;
					}
					L5:
					L5:
					if(_t70 == 0xffffffff || _t70 > GetTickCount() - _t73[4]) {
						goto L8;
					} else {
						 *_t73 = 0;
					}
					break;
					L8:
					if( *_t71 > 1) {
						goto L13;
					}
					if( *_t71 != 0) {
						L12:
						E00406368( &(_t73[0xc]));
						_t72 = _t72 - 1;
						if(_t72 > 0) {
							goto L5;
						}
						goto L13;
					}
					asm("lock cmpxchg [esi], edx");
					if(0 != 0) {
						goto L12;
					}
					_t71[8] = GetCurrentThreadId();
					_t71[4] = 1;
					 *_t73 = 1;
					break;
				}
				L32:
				return  *_t73 & 0x000000ff;
			}











                                                                                          0x0040668f
                                                                                          0x00406691
                                                                                          0x00406693
                                                                                          0x00406696
                                                                                          0x00406696
                                                                                          0x0040669d
                                                                                          0x004066a4
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004066b2
                                                                                          0x004066b9
                                                                                          0x00406751
                                                                                          0x00406751
                                                                                          0x00406751
                                                                                          0x00406755
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406760
                                                                                          0x00406766
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406768
                                                                                          0x00406768
                                                                                          0x0040676d
                                                                                          0x00406773
                                                                                          0x0040677a
                                                                                          0x00406784
                                                                                          0x00406789
                                                                                          0x00406790
                                                                                          0x00406797
                                                                                          0x004067a5
                                                                                          0x004067b3
                                                                                          0x004067a7
                                                                                          0x004067af
                                                                                          0x004067af
                                                                                          0x004067a5
                                                                                          0x004067b9
                                                                                          0x004067db
                                                                                          0x004067e4
                                                                                          0x004067e8
                                                                                          0x004067ec
                                                                                          0x00000000
                                                                                          0x004067bb
                                                                                          0x004067bb
                                                                                          0x004067c0
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004067cc
                                                                                          0x004067d2
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004067d4
                                                                                          0x00000000
                                                                                          0x004067d4
                                                                                          0x004067bb
                                                                                          0x004067f1
                                                                                          0x004067f1
                                                                                          0x00406800
                                                                                          0x00406807
                                                                                          0x0040680a
                                                                                          0x0040680a
                                                                                          0x00000000
                                                                                          0x00406800
                                                                                          0x00000000
                                                                                          0x00406751
                                                                                          0x004066c4
                                                                                          0x004066ca
                                                                                          0x004066d0
                                                                                          0x0040672c
                                                                                          0x0040672f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406736
                                                                                          0x0040673e
                                                                                          0x00406744
                                                                                          0x0040674f
                                                                                          0x00000000
                                                                                          0x0040674f
                                                                                          0x00406746
                                                                                          0x00000000
                                                                                          0x00406746
                                                                                          0x00000000
                                                                                          0x004066d2
                                                                                          0x004066d5
                                                                                          0x00000000
                                                                                          0x004066e4
                                                                                          0x004066e4
                                                                                          0x004066e4
                                                                                          0x00000000
                                                                                          0x004066ed
                                                                                          0x004066f0
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004066f5
                                                                                          0x0040671e
                                                                                          0x00406722
                                                                                          0x00406727
                                                                                          0x0040672a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040672a
                                                                                          0x004066fe
                                                                                          0x00406704
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040670b
                                                                                          0x0040670e
                                                                                          0x00406715
                                                                                          0x00000000
                                                                                          0x00406715
                                                                                          0x00406811
                                                                                          0x0040681c

                                                                                          APIs
                                                                                            • Part of subcall function 00406B30: GetCurrentThreadId.KERNEL32 ref: 00406B33
                                                                                          • GetTickCount.KERNEL32 ref: 004066BF
                                                                                          • GetTickCount.KERNEL32 ref: 004066D7
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00406706
                                                                                          • GetTickCount.KERNEL32 ref: 00406731
                                                                                          • GetTickCount.KERNEL32 ref: 00406768
                                                                                          • GetTickCount.KERNEL32 ref: 00406792
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00406802
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountTick$CurrentThread
                                                                                          • String ID:
                                                                                          • API String ID: 3968769311-0
                                                                                          • Opcode ID: d68569389b1874426944dbdaf855cb9de5dde29c2ee803ff208aff5c928e2b2c
                                                                                          • Instruction ID: 4198438d609b3d92ee1caba3903e9c970ac06421e97b93dd9799f90313ce3de1
                                                                                          • Opcode Fuzzy Hash: d68569389b1874426944dbdaf855cb9de5dde29c2ee803ff208aff5c928e2b2c
                                                                                          • Instruction Fuzzy Hash: 664182712083419ED721AE3CC58431BBAD5AF80358F16C93ED4DA973C1EB7988958756
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004971AC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 80%
                                                                                          			E004971AC(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* _t23;
				char _t29;
				void* _t50;
				intOrPtr _t55;
				char _t57;
				intOrPtr _t59;
				void* _t64;
				void* _t66;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t64 = __edi;
				_t57 = __edx;
				_t50 = __ecx;
				_t68 = _t69;
				_t70 = _t69 + 0xfffffff0;
				_v20 = 0;
				if(__edx != 0) {
					_t70 = _t70 + 0xfffffff0;
					_t23 = E004062B0(_t23, _t68);
				}
				_t49 = _t50;
				_v5 = _t57;
				_t66 = _t23;
				_push(_t68);
				_push(0x4972a5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70;
				E00405CB8(0);
				_t3 = _t66 + 0x2c; // 0x266461
				 *(_t66 + 0xf) =  *_t3 & 0x000000ff ^ 0x00000001;
				if(_t50 == 0 ||  *(_t66 + 0x2c) != 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				 *((char*)(_t66 + 0xd)) = _t29;
				if( *(_t66 + 0x2c) != 0) {
					 *((intOrPtr*)(_t66 + 8)) = GetCurrentThread();
					 *((intOrPtr*)(_t66 + 4)) = GetCurrentThreadId();
				} else {
					if(_a4 == 0) {
						_t12 = _t66 + 4; // 0x495548
						 *((intOrPtr*)(_t66 + 8)) = E004078E0(0, E004970B8, 0, _t12, 4, _t66);
					} else {
						_t9 = _t66 + 4; // 0x495548
						 *((intOrPtr*)(_t66 + 8)) = E004078E0(0, E004970B8, _a4, _t9, 0x10004, _t66);
					}
					if( *((intOrPtr*)(_t66 + 8)) == 0) {
						E0041DFB0(GetLastError(), _t49, 0, _t66);
						_v16 = _v20;
						_v12 = 0x11;
						_t55 =  *0x4ba740; // 0x40ea6c
						E0041F35C(_t49, _t55, 1, _t64, _t66, 0,  &_v16);
						E0040711C();
					}
				}
				_pop(_t59);
				 *[fs:eax] = _t59;
				_push(0x4972ac);
				return E00407A20( &_v20);
			}


















                                                                                          0x004971ac
                                                                                          0x004971ac
                                                                                          0x004971ac
                                                                                          0x004971ad
                                                                                          0x004971af
                                                                                          0x004971b6
                                                                                          0x004971bb
                                                                                          0x004971bd
                                                                                          0x004971c0
                                                                                          0x004971c0
                                                                                          0x004971c5
                                                                                          0x004971c7
                                                                                          0x004971ca
                                                                                          0x004971ce
                                                                                          0x004971cf
                                                                                          0x004971d4
                                                                                          0x004971d7
                                                                                          0x004971de
                                                                                          0x004971e3
                                                                                          0x004971e9
                                                                                          0x004971ee
                                                                                          0x004971f6
                                                                                          0x004971fa
                                                                                          0x004971fa
                                                                                          0x004971fa
                                                                                          0x004971fc
                                                                                          0x00497203
                                                                                          0x00497284
                                                                                          0x0049728c
                                                                                          0x00497205
                                                                                          0x00497209
                                                                                          0x0049722c
                                                                                          0x0049723e
                                                                                          0x0049720b
                                                                                          0x00497211
                                                                                          0x00497224
                                                                                          0x00497224
                                                                                          0x00497245
                                                                                          0x00497251
                                                                                          0x00497259
                                                                                          0x0049725c
                                                                                          0x00497266
                                                                                          0x00497273
                                                                                          0x00497278
                                                                                          0x00497278
                                                                                          0x00497245
                                                                                          0x00497291
                                                                                          0x00497294
                                                                                          0x00497297
                                                                                          0x004972a4

                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,004972A5,?,00495544,00000000), ref: 00497247
                                                                                            • Part of subcall function 004078E0: CreateThread.KERNEL32 ref: 0040793A
                                                                                          • GetCurrentThread.KERNEL32 ref: 0049727F
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00497287
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$Current$CreateErrorLast
                                                                                          • String ID: 0@G$XtI$l@
                                                                                          • API String ID: 3539746228-385768319
                                                                                          • Opcode ID: a4dc03de5b91be95089a9569e035fcfb45136a4f5e23dfed5c7514759ebadc63
                                                                                          • Instruction ID: 1159262e71bebd7e921a745d602ab6fc0c684f98ff6f66721209a3575415716a
                                                                                          • Opcode Fuzzy Hash: a4dc03de5b91be95089a9569e035fcfb45136a4f5e23dfed5c7514759ebadc63
                                                                                          • Instruction Fuzzy Hash: 2B31E2309287449EDB10EBB68C427AB7FE49F09304F40C87EE455973C1DA3CA545C799
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004076B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 43%
                                                                                          			E004076B8(void* __ecx) {
				long _v4;
				void* _t3;
				void* _t9;

				if( *0x4bb058 == 0) {
					if( *0x4b7032 == 0) {
						_push(0);
						_push("Error");
						_push("Runtime error     at 00000000");
						_push(0);
						L00403780();
					}
					return _t3;
				} else {
					if( *0x4bb344 == 0xd7b2 &&  *0x4bb34c > 0) {
						 *0x4bb35c();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E00408240(0x40774c);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}






                                                                                          0x004076c0
                                                                                          0x00407726
                                                                                          0x00407728
                                                                                          0x0040772a
                                                                                          0x0040772f
                                                                                          0x00407734
                                                                                          0x00407736
                                                                                          0x00407736
                                                                                          0x0040773c
                                                                                          0x004076c2
                                                                                          0x004076cb
                                                                                          0x004076db
                                                                                          0x004076db
                                                                                          0x004076f7
                                                                                          0x0040770a
                                                                                          0x0040771e
                                                                                          0x0040771e

                                                                                          APIs
                                                                                          • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
                                                                                          • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
                                                                                          • GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
                                                                                          • WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite
                                                                                          • String ID: Error$Runtime error at 00000000
                                                                                          • API String ID: 3320372497-2970929446
                                                                                          • Opcode ID: 06894f85802f1aca0c877f66b17294aabd6ee15dfccdef8be12070d3d0c4ead6
                                                                                          • Instruction ID: db14fa18f2a627875cbdcf208ba1e0af1765c14dc112cf76e17f9611cef7a876
                                                                                          • Opcode Fuzzy Hash: 06894f85802f1aca0c877f66b17294aabd6ee15dfccdef8be12070d3d0c4ead6
                                                                                          • Instruction Fuzzy Hash: DFF0C2A1A8C24079FA2077A94C47F5A269C8740B16F108A3FF610B61D1C7FD6584937E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00420524 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 20COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00420524(void* __ebx, void* __esi) {
				intOrPtr _t4;
				intOrPtr _t6;

				if(E0041FF68(6, 0) == 0) {
					_t4 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"NTDLL.DLL"), L"RtlCompareUnicodeString");
					 *0x4be914 = _t4;
					 *0x4be910 = E00420428;
					return _t4;
				} else {
					_t6 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"CompareStringOrdinal");
					 *0x4be910 = _t6;
					return _t6;
				}
			}





                                                                                          0x00420532
                                                                                          0x0042055f
                                                                                          0x00420564
                                                                                          0x00420569
                                                                                          0x00420573
                                                                                          0x00420534
                                                                                          0x00420544
                                                                                          0x00420549
                                                                                          0x0042054e
                                                                                          0x0042054e

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,CompareStringOrdinal,004B5A2E,00000000,004B5A41), ref: 0042053E
                                                                                            • Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2
                                                                                          • GetModuleHandleW.KERNEL32(NTDLL.DLL,RtlCompareUnicodeString,004B5A2E,00000000,004B5A41), ref: 00420559
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: HandleModule$AddressProc
                                                                                          • String ID: CompareStringOrdinal$NTDLL.DLL$RtlCompareUnicodeString$kernel32.dll
                                                                                          • API String ID: 1883125708-3870080525
                                                                                          • Opcode ID: b7bf267469631706014ef5b6a976724c1e29590bd579973413919bb6c8384525
                                                                                          • Instruction ID: 4ba185d4141586243d2650af69d43cb091b5da9faf927984522c9bbe9ad7037f
                                                                                          • Opcode Fuzzy Hash: b7bf267469631706014ef5b6a976724c1e29590bd579973413919bb6c8384525
                                                                                          • Instruction Fuzzy Hash: 04E08CF0B4232036E644FB672C0769929C51B85709BD04A3F7004BA1D7DBBE42659E2E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042931C Relevance: 9.1, APIs: 6, Instructions: 144COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 77%
                                                                                          			E0042931C(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				signed short* _v808;
				void* __ebp;
				signed char _t55;
				signed int _t64;
				void* _t72;
				intOrPtr* _t83;
				void* _t103;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr* _t118;
				void* _t122;
				intOrPtr _t123;
				char* _t124;
				void* _t125;

				_t110 = __ecx;
				_v780 = __ecx;
				_v808 = __edx;
				_v776 = __eax;
				if((_v808[0] & 0x00000020) == 0) {
					E00428FDC(0x80070057);
				}
				_t55 =  *_v808 & 0x0000ffff;
				if((_t55 & 0x00000fff) != 0xc) {
					_push(_v808);
					_push(_v776);
					L00427254();
					return E00428FDC(_v776);
				} else {
					if((_t55 & 0x00000040) == 0) {
						_v792 = _v808[4];
					} else {
						_v792 =  *(_v808[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t103 = _v788 - 1;
					if(_t103 < 0) {
						L9:
						_push( &_v772);
						_t64 = _v788;
						_push(_t64);
						_push(0xc);
						L00427828();
						_t123 = _t64;
						if(_t123 == 0) {
							E00428D34(_t110);
						}
						E00429278(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t123;
						_t105 = _v788 - 1;
						if(_t105 < 0) {
							L14:
							_t107 = _v788 - 1;
							if(E00429294(_v788 - 1, _t125) != 0) {
								L00427840();
								E00428FDC(_v792);
								L00427840();
								E00428FDC( &_v260);
								_v780(_t123,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t72 = E004292C4(_t107, _t125);
						} else {
							_t108 = _t105 + 1;
							_t83 =  &_v768;
							_t118 =  &_v260;
							do {
								 *_t118 =  *_t83;
								_t118 = _t118 + 4;
								_t83 = _t83 + 8;
								_t108 = _t108 - 1;
							} while (_t108 != 0);
							do {
								goto L14;
							} while (_t72 != 0);
							return _t72;
						}
					} else {
						_t109 = _t103 + 1;
						_t122 = 0;
						_t124 =  &_v772;
						do {
							_v804 = _t124;
							_push(_v804 + 4);
							_t23 = _t122 + 1; // 0x1
							_push(_v792);
							L00427830();
							E00428FDC(_v792);
							_push( &_v784);
							_t26 = _t122 + 1; // 0x1
							_push(_v792);
							L00427838();
							E00428FDC(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t122 = _t122 + 1;
							_t124 = _t124 + 8;
							_t109 = _t109 - 1;
						} while (_t109 != 0);
						goto L9;
					}
				}
			}





























                                                                                          0x0042931c
                                                                                          0x00429328
                                                                                          0x0042932e
                                                                                          0x00429334
                                                                                          0x00429344
                                                                                          0x0042934b
                                                                                          0x0042934b
                                                                                          0x00429356
                                                                                          0x00429364
                                                                                          0x004294ef
                                                                                          0x004294f6
                                                                                          0x004294f7
                                                                                          0x00000000
                                                                                          0x0042936a
                                                                                          0x0042936d
                                                                                          0x0042938b
                                                                                          0x0042936f
                                                                                          0x0042937a
                                                                                          0x0042937a
                                                                                          0x0042939a
                                                                                          0x004293a6
                                                                                          0x004293a9
                                                                                          0x00429416
                                                                                          0x0042941c
                                                                                          0x0042941d
                                                                                          0x00429423
                                                                                          0x00429424
                                                                                          0x00429426
                                                                                          0x0042942b
                                                                                          0x0042942f
                                                                                          0x00429431
                                                                                          0x00429431
                                                                                          0x0042943c
                                                                                          0x00429447
                                                                                          0x00429452
                                                                                          0x0042945b
                                                                                          0x0042945e
                                                                                          0x0042947a
                                                                                          0x00429481
                                                                                          0x0042948c
                                                                                          0x004294a3
                                                                                          0x004294a8
                                                                                          0x004294bc
                                                                                          0x004294c1
                                                                                          0x004294d4
                                                                                          0x004294d4
                                                                                          0x004294dd
                                                                                          0x00429460
                                                                                          0x00429460
                                                                                          0x00429461
                                                                                          0x00429467
                                                                                          0x0042946d
                                                                                          0x0042946f
                                                                                          0x00429471
                                                                                          0x00429474
                                                                                          0x00429477
                                                                                          0x00429477
                                                                                          0x0042947a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0042947a
                                                                                          0x004293ab
                                                                                          0x004293ab
                                                                                          0x004293ac
                                                                                          0x004293ae
                                                                                          0x004293b4
                                                                                          0x004293b6
                                                                                          0x004293c5
                                                                                          0x004293c6
                                                                                          0x004293d0
                                                                                          0x004293d1
                                                                                          0x004293d6
                                                                                          0x004293e1
                                                                                          0x004293e2
                                                                                          0x004293ec
                                                                                          0x004293ed
                                                                                          0x004293f2
                                                                                          0x0042940d
                                                                                          0x0042940f
                                                                                          0x00429410
                                                                                          0x00429413
                                                                                          0x00429413
                                                                                          0x00000000
                                                                                          0x004293b4
                                                                                          0x004293a9

                                                                                          APIs
                                                                                          • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004293D1
                                                                                          • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004293ED
                                                                                          • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00429426
                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004294A3
                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004294BC
                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 004294F7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                          • String ID:
                                                                                          • API String ID: 351091851-0
                                                                                          • Opcode ID: 098dc979d013d57468a629589b458cb88fc05e19e5f0a5a7df6b54d31b1502c0
                                                                                          • Instruction ID: 2fed5c09d90993a71d142947efe00684c7910c2ed580f9cb9a97fb5731140b2d
                                                                                          • Opcode Fuzzy Hash: 098dc979d013d57468a629589b458cb88fc05e19e5f0a5a7df6b54d31b1502c0
                                                                                          • Instruction Fuzzy Hash: 4B51EE75A012299FCB21DB59D981BDAB3FCAF0C304F8041DAF548E7211D634AF858F65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041EEFC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 85%
                                                                                          			E0041EEFC(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				struct HINSTANCE__* _t44;
				intOrPtr _t55;
				struct HINSTANCE__* _t57;
				signed int _t76;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;

				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x41f0a8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000 || GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105) == 0) {
					_t44 =  *0x4be634; // 0x400000
					GetModuleFileNameW(_t44,  &_v1056, 0x105);
					_v12 = E0041EEF0(_t82);
				} else {
					_v12 = _t82 - _v1596.AllocationBase;
				}
				E0041A57C( &_v534, 0x104, E00420608() + 2);
				_t83 = 0x41f0bc;
				_t100 = 0x41f0bc;
				_t95 =  *0x414db8; // 0x414e10
				if(E00405F30(_t102, _t95) != 0) {
					_t83 = E004084EC( *((intOrPtr*)(_t102 + 4)));
					_t76 = E00407F04(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x41f0c0;
					}
				}
				_t55 =  *0x4ba774; // 0x40e708
				_t18 = _t55 + 4; // 0xffec
				_t57 =  *0x4be634; // 0x400000
				LoadStringW(E00409FF0(_t57),  *_t18,  &_v1568, 0x100);
				E00405BE8( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				E0041A814(4,  &_v1636);
				E00407F04(_v8);
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(0x41f0af);
				return E00407A20( &_v1640);
			}































                                                                                          0x0041ef0a
                                                                                          0x0041ef10
                                                                                          0x0041ef13
                                                                                          0x0041ef15
                                                                                          0x0041ef19
                                                                                          0x0041ef1a
                                                                                          0x0041ef1f
                                                                                          0x0041ef22
                                                                                          0x0041ef2f
                                                                                          0x0041ef3e
                                                                                          0x0041ef68
                                                                                          0x0041ef6e
                                                                                          0x0041ef7a
                                                                                          0x0041ef7f
                                                                                          0x0041ef85
                                                                                          0x0041ef85
                                                                                          0x0041efa7
                                                                                          0x0041efac
                                                                                          0x0041efb1
                                                                                          0x0041efb8
                                                                                          0x0041efc5
                                                                                          0x0041efcf
                                                                                          0x0041efd3
                                                                                          0x0041efda
                                                                                          0x0041efe4
                                                                                          0x0041efe4
                                                                                          0x0041efda
                                                                                          0x0041eff5
                                                                                          0x0041effa
                                                                                          0x0041effe
                                                                                          0x0041f009
                                                                                          0x0041f016
                                                                                          0x0041f021
                                                                                          0x0041f027
                                                                                          0x0041f034
                                                                                          0x0041f03a
                                                                                          0x0041f044
                                                                                          0x0041f04a
                                                                                          0x0041f051
                                                                                          0x0041f057
                                                                                          0x0041f05e
                                                                                          0x0041f064
                                                                                          0x0041f080
                                                                                          0x0041f088
                                                                                          0x0041f091
                                                                                          0x0041f094
                                                                                          0x0041f097
                                                                                          0x0041f0a7

                                                                                          APIs
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F0A8), ref: 0041EF2F
                                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF53
                                                                                          • GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0041EF6E
                                                                                          • LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F009
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                          • String ID: MZP
                                                                                          • API String ID: 3990497365-2889622443
                                                                                          • Opcode ID: b8be0fea34dc80bb7553a8da0885c656d5cafed23f6e23429f91232411ad397e
                                                                                          • Instruction ID: 1578eb45e464442e6080653f6025888c356fcaddc808aab3f6789ba0ce71ce89
                                                                                          • Opcode Fuzzy Hash: b8be0fea34dc80bb7553a8da0885c656d5cafed23f6e23429f91232411ad397e
                                                                                          • Instruction Fuzzy Hash: 3E412374A002589FDB20DF59CC81BCAB7F9AB58304F4044FAE508E7242D7799E95CF59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AFA44 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 34%
                                                                                          			E004AFA44(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void* _t24;
				intOrPtr _t28;
				void* _t31;
				void* _t32;
				intOrPtr _t35;

				_t32 = __esi;
				_t31 = __edi;
				_push(0);
				_push(0);
				_t24 = __eax;
				_push(_t35);
				_push(0x4aface);
				_push( *[fs:eax]);
				 *[fs:eax] = _t35;
				if(( *0x4c1d61 & 0x00000001) == 0) {
					E00407A20( &_v8);
				} else {
					E00407E48( &_v8, L"/ALLUSERS\r\nInstructs Setup to install in administrative install mode.\r\n/CURRENTUSER\r\nInstructs Setup to install in non administrative install mode.\r\n");
				}
				_push(L"The Setup program accepts optional command line parameters.\r\n\r\n/HELP, /?\r\nShows this information.\r\n/SP-\r\nDisables the This will install... Do you wish to continue? prompt at the beginning of Setup.\r\n/SILENT, /VERYSILENT\r\nInstructs Setup to be silent or very silent.\r\n/SUPPRESSMSGBOXES\r\nInstructs Setup to suppress message boxes.\r\n/LOG\r\nCauses Setup to create a log file in the user\'s TEMP directory.\r\n/LOG=\"filename\"\r\nSame as /LOG, except it allows you to specify a fixed path/filename to use for the log file.\r\n/NOCANCEL\r\nPrevents the user from cancelling during the installation process.\r\n/NORESTART\r\nPrevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.\r\n/RESTARTEXITCODE=exit code\r\nSpecifies a custom exit code that Setup is to return when the system needs to be restarted.\r\n/CLOSEAPPLICATIONS\r\nInstructs Setup to close applications using files that need to be updated.\r\n/NOCLOSEAPPLICATIONS\r\nPrevents Setup from closing applications using files that need to be updated.\r\n/FORCECLOSEAPPLICATIONS\r\nInstructs Setup to force close when closing applications.\r\n/FORCENOCLOSEAPPLICATIONS\r\nPrevents Setup from force closing when closing applications.\r\n/LOGCLOSEAPPLICATIONS\r\nInstructs Setup to create extra logging when closing applications for debugging purposes.\r\n/RESTARTAPPLICATIONS\r\nInstructs Setup to restart applications.\r\n/NORESTARTAPPLICATIONS\r\nPrevents Setup from restarting applications.\r\n/LOADINF=\"filename\"\r\nInstructs Setup to load the settings from the specified file after having checked the command line.\r\n/SAVEINF=\"filename\"\r\nInstructs Setup to save installation settings to the specified file.\r\n/LANG=language\r\nSpecifies the internal name of the language to use.\r\n/DIR=\"x:\\dirname\"\r\nOverrides the default directory name.\r\n/GROUP=\"folder name\"\r\nOverrides the default folder name.\r\n/NOICONS\r\nInstructs Setup to initially check the Don\'t create a Start Menu folder check box.\r\n/TYPE=type name\r\nOverrides the default setup type.\r\n/COMPONENTS=\"comma separated list of component names\"\r\nOverrides the default component settings.\r\n/TASKS=\"comma separated list of task names\"\r\nSpecifies a list of tasks that should be initially selected.\r\n/MERGETASKS=\"comma separated list of task names\"\r\nLike the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.\r\n/PASSWORD=password\r\nSpecifies the password to use.\r\n");
				_push(_v8);
				_push(_t24);
				_push(0x4b0f94);
				_push(L"For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline");
				E004087C4( &_v12, _t24, 5, _t31, _t32);
				MessageBoxW(0, E004084EC(_v12), L"Setup", 0x10);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E004AFAD5);
				return E00407A80( &_v12, 2);
			}










                                                                                          0x004afa44
                                                                                          0x004afa44
                                                                                          0x004afa47
                                                                                          0x004afa49
                                                                                          0x004afa4c
                                                                                          0x004afa50
                                                                                          0x004afa51
                                                                                          0x004afa56
                                                                                          0x004afa59
                                                                                          0x004afa63
                                                                                          0x004afa77
                                                                                          0x004afa65
                                                                                          0x004afa6d
                                                                                          0x004afa6d
                                                                                          0x004afa7c
                                                                                          0x004afa81
                                                                                          0x004afa84
                                                                                          0x004afa85
                                                                                          0x004afa8a
                                                                                          0x004afa97
                                                                                          0x004afaae
                                                                                          0x004afab5
                                                                                          0x004afab8
                                                                                          0x004afabb
                                                                                          0x004afacd

                                                                                          APIs
                                                                                          • MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004AFAAE
                                                                                          Strings
                                                                                          • For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, xrefs: 004AFA8A
                                                                                          • The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in, xrefs: 004AFA7C
                                                                                          • Setup, xrefs: 004AFA9E
                                                                                          • /ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat, xrefs: 004AFA68
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message
                                                                                          • String ID: /ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat$For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline$Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in
                                                                                          • API String ID: 2030045667-3391638011
                                                                                          • Opcode ID: 66245cf56300a1c7c541050b9d52e7f7cee767bf73c9c42da64b4bca2bf40a85
                                                                                          • Instruction ID: 307a18092975e57fce7d36cb0845ad1ef4e0a75d88e156d2955b45763d379f25
                                                                                          • Opcode Fuzzy Hash: 66245cf56300a1c7c541050b9d52e7f7cee767bf73c9c42da64b4bca2bf40a85
                                                                                          • Instruction Fuzzy Hash: D701A230748308BBE711E7D1CD52FDEB6A8D74AB04FA0047BB904B25D1D6BC6A09852D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042F9B8 Relevance: 7.8, APIs: 5, Instructions: 335COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 69%
                                                                                          			E0042F9B8(signed short* __eax, signed int __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed int _v8;
				signed char _v9;
				signed int _v12;
				signed int _v14;
				void* _v20;
				void* _v24;
				signed short* _v28;
				signed short* _v32;
				signed int _v48;
				void* __ebx;
				void* __ebp;
				signed int _t150;
				signed int _t272;
				intOrPtr _t328;
				intOrPtr _t331;
				intOrPtr _t339;
				intOrPtr _t347;
				intOrPtr _t355;
				void* _t360;
				void* _t362;
				intOrPtr _t363;

				_t367 = __fp0;
				_t358 = __edi;
				_t360 = _t362;
				_t363 = _t362 + 0xffffffd4;
				_v8 = __ecx;
				_v32 = __edx;
				_v28 = __eax;
				_v9 = 1;
				_t272 =  *_v28 & 0x0000ffff;
				if((_t272 & 0x00000fff) >= 0x10f) {
					_t150 =  *_v32 & 0x0000ffff;
					if(_t150 != 0) {
						if(_t150 != 1) {
							if(E00430860(_t272,  &_v20) != 0) {
								_push( &_v14);
								_t273 =  *_v20;
								if( *((intOrPtr*)( *_v20 + 8))() == 0) {
									_t275 =  *_v32 & 0x0000ffff;
									if(( *_v32 & 0xfff) >= 0x10f) {
										if(E00430860(_t275,  &_v24) != 0) {
											_push( &_v12);
											_t276 =  *_v24;
											if( *((intOrPtr*)( *_v24 + 4))() == 0) {
												E00428BF0(0xb);
												goto L41;
											} else {
												if(( *_v28 & 0x0000ffff) == _v12) {
													_t143 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4b93d2 + _v8 * 2 + _t143) & 0x000000ff;
													goto L41;
												} else {
													_push( &_v48);
													L00427244();
													_push(_t360);
													_push(0x42fdb0);
													_push( *[fs:eax]);
													 *[fs:eax] = _t363;
													_t289 = _v12 & 0x0000ffff;
													E004299A4( &_v48, _t276, _v12 & 0x0000ffff, _v28, __edi, __fp0);
													if((_v48 & 0x0000ffff) != _v12) {
														E00428AF8(_t289);
													}
													_t131 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4b93d2 + _v8 * 2 + _t131) & 0x000000ff;
													_pop(_t328);
													 *[fs:eax] = _t328;
													_push(0x42fde5);
													return E00429278( &_v48);
												}
											}
										} else {
											E00428BF0(0xb);
											goto L41;
										}
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42fcf7);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t294 =  *_v32 & 0x0000ffff;
										E004299A4( &_v48, _t275,  *_v32 & 0x0000ffff, _v28, __edi, __fp0);
										if(( *_v32 & 0x0000ffff) != _v48) {
											E00428AF8(_t294);
										}
										_v9 = E0042F7D0( &_v48, _v8, _v32, _t358, _t360, _t367);
										_pop(_t331);
										 *[fs:eax] = _t331;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								} else {
									if(( *_v32 & 0x0000ffff) == _v14) {
										_t95 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t95) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42fc52);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t299 = _v14 & 0x0000ffff;
										E004299A4( &_v48, _t273, _v14 & 0x0000ffff, _v32, __edi, __fp0);
										if((_v48 & 0x0000ffff) != _v14) {
											E00428AF8(_t299);
										}
										_t83 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t83) & 0x000000ff;
										_pop(_t339);
										 *[fs:eax] = _t339;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								}
							} else {
								E00428BF0(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F550(_v8, 2);
							goto L41;
						}
					} else {
						_v9 = E0042F53C(0, 1);
						goto L41;
					}
				} else {
					if(_t272 != 0) {
						if(_t272 != 1) {
							if(E00430860( *_v32 & 0x0000ffff,  &_v24) != 0) {
								_push( &_v12);
								_t282 =  *_v24;
								if( *((intOrPtr*)( *_v24 + 4))() == 0) {
									_push( &_v48);
									L00427244();
									_push(_t360);
									_push(0x42fb63);
									_push( *[fs:eax]);
									 *[fs:eax] = _t363;
									_t306 =  *_v28 & 0x0000ffff;
									E004299A4( &_v48, _t282,  *_v28 & 0x0000ffff, _v32, __edi, __fp0);
									if((_v48 & 0xfff) !=  *_v28) {
										E00428AF8(_t306);
									}
									_v9 = E0042F7D0(_v28, _v8,  &_v48, _t358, _t360, _t367);
									_pop(_t347);
									 *[fs:eax] = _t347;
									_push(0x42fde5);
									return E00429278( &_v48);
								} else {
									if(( *_v28 & 0x0000ffff) == _v12) {
										_t44 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t44) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42facc);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t311 = _v12 & 0x0000ffff;
										E004299A4( &_v48, _t282, _v12 & 0x0000ffff, _v28, __edi, __fp0);
										if((_v48 & 0xfff) != _v12) {
											E00428AF8(_t311);
										}
										_t32 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t32) & 0x000000ff;
										_pop(_t355);
										 *[fs:eax] = _t355;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								}
							} else {
								E00428BF0(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F550(_v8, 0);
							goto L41;
						}
					} else {
						_v9 = E0042F53C(1, 0);
						L41:
						return _v9 & 0x000000ff;
					}
				}
			}
























                                                                                          0x0042f9b8
                                                                                          0x0042f9b8
                                                                                          0x0042f9b9
                                                                                          0x0042f9bb
                                                                                          0x0042f9bf
                                                                                          0x0042f9c2
                                                                                          0x0042f9c5
                                                                                          0x0042f9c8
                                                                                          0x0042f9cf
                                                                                          0x0042f9dc
                                                                                          0x0042fb6d
                                                                                          0x0042fb73
                                                                                          0x0042fb8a
                                                                                          0x0042fbac
                                                                                          0x0042fbbb
                                                                                          0x0042fbc7
                                                                                          0x0042fbce
                                                                                          0x0042fc88
                                                                                          0x0042fc95
                                                                                          0x0042fd0a
                                                                                          0x0042fd19
                                                                                          0x0042fd25
                                                                                          0x0042fd2c
                                                                                          0x0042fde0
                                                                                          0x00000000
                                                                                          0x0042fd32
                                                                                          0x0042fd3c
                                                                                          0x0042fdd6
                                                                                          0x0042fddb
                                                                                          0x00000000
                                                                                          0x0042fd3e
                                                                                          0x0042fd41
                                                                                          0x0042fd42
                                                                                          0x0042fd49
                                                                                          0x0042fd4a
                                                                                          0x0042fd4f
                                                                                          0x0042fd52
                                                                                          0x0042fd55
                                                                                          0x0042fd5f
                                                                                          0x0042fd6c
                                                                                          0x0042fd6e
                                                                                          0x0042fd6e
                                                                                          0x0042fd92
                                                                                          0x0042fd97
                                                                                          0x0042fd9c
                                                                                          0x0042fd9f
                                                                                          0x0042fda2
                                                                                          0x0042fdaf
                                                                                          0x0042fdaf
                                                                                          0x0042fd3c
                                                                                          0x0042fd0c
                                                                                          0x0042fd0c
                                                                                          0x00000000
                                                                                          0x0042fd0c
                                                                                          0x0042fc97
                                                                                          0x0042fc9a
                                                                                          0x0042fc9b
                                                                                          0x0042fca2
                                                                                          0x0042fca3
                                                                                          0x0042fca8
                                                                                          0x0042fcab
                                                                                          0x0042fcb1
                                                                                          0x0042fcba
                                                                                          0x0042fcc9
                                                                                          0x0042fccb
                                                                                          0x0042fccb
                                                                                          0x0042fcde
                                                                                          0x0042fce3
                                                                                          0x0042fce6
                                                                                          0x0042fce9
                                                                                          0x0042fcf6
                                                                                          0x0042fcf6
                                                                                          0x0042fbd4
                                                                                          0x0042fbde
                                                                                          0x0042fc78
                                                                                          0x0042fc7d
                                                                                          0x00000000
                                                                                          0x0042fbe0
                                                                                          0x0042fbe3
                                                                                          0x0042fbe4
                                                                                          0x0042fbeb
                                                                                          0x0042fbec
                                                                                          0x0042fbf1
                                                                                          0x0042fbf4
                                                                                          0x0042fbf7
                                                                                          0x0042fc01
                                                                                          0x0042fc0e
                                                                                          0x0042fc10
                                                                                          0x0042fc10
                                                                                          0x0042fc34
                                                                                          0x0042fc39
                                                                                          0x0042fc3e
                                                                                          0x0042fc41
                                                                                          0x0042fc44
                                                                                          0x0042fc51
                                                                                          0x0042fc51
                                                                                          0x0042fbde
                                                                                          0x0042fbae
                                                                                          0x0042fbae
                                                                                          0x00000000
                                                                                          0x0042fbae
                                                                                          0x0042fb8c
                                                                                          0x0042fb98
                                                                                          0x00000000
                                                                                          0x0042fb98
                                                                                          0x0042fb75
                                                                                          0x0042fb7e
                                                                                          0x00000000
                                                                                          0x0042fb7e
                                                                                          0x0042f9e2
                                                                                          0x0042f9e5
                                                                                          0x0042f9fc
                                                                                          0x0042fa22
                                                                                          0x0042fa31
                                                                                          0x0042fa3d
                                                                                          0x0042fa44
                                                                                          0x0042fb02
                                                                                          0x0042fb03
                                                                                          0x0042fb0a
                                                                                          0x0042fb0b
                                                                                          0x0042fb10
                                                                                          0x0042fb13
                                                                                          0x0042fb19
                                                                                          0x0042fb22
                                                                                          0x0042fb35
                                                                                          0x0042fb37
                                                                                          0x0042fb37
                                                                                          0x0042fb4a
                                                                                          0x0042fb4f
                                                                                          0x0042fb52
                                                                                          0x0042fb55
                                                                                          0x0042fb62
                                                                                          0x0042fa4a
                                                                                          0x0042fa54
                                                                                          0x0042faf2
                                                                                          0x0042faf7
                                                                                          0x00000000
                                                                                          0x0042fa56
                                                                                          0x0042fa59
                                                                                          0x0042fa5a
                                                                                          0x0042fa61
                                                                                          0x0042fa62
                                                                                          0x0042fa67
                                                                                          0x0042fa6a
                                                                                          0x0042fa6d
                                                                                          0x0042fa77
                                                                                          0x0042fa88
                                                                                          0x0042fa8a
                                                                                          0x0042fa8a
                                                                                          0x0042faae
                                                                                          0x0042fab3
                                                                                          0x0042fab8
                                                                                          0x0042fabb
                                                                                          0x0042fabe
                                                                                          0x0042facb
                                                                                          0x0042facb
                                                                                          0x0042fa54
                                                                                          0x0042fa24
                                                                                          0x0042fa24
                                                                                          0x00000000
                                                                                          0x0042fa24
                                                                                          0x0042f9fe
                                                                                          0x0042fa0a
                                                                                          0x00000000
                                                                                          0x0042fa0a
                                                                                          0x0042f9e7
                                                                                          0x0042f9f0
                                                                                          0x0042fde5
                                                                                          0x0042fded
                                                                                          0x0042fded
                                                                                          0x0042f9e5

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c6922fb93c990c72bf9a49bf3daa94017bfe3b7264ddd93f55e738123a9900a9
                                                                                          • Instruction ID: 1b6310f250808118d38827de8a535e3b6e70e535f73b2508e71121fbf0c58563
                                                                                          • Opcode Fuzzy Hash: c6922fb93c990c72bf9a49bf3daa94017bfe3b7264ddd93f55e738123a9900a9
                                                                                          • Instruction Fuzzy Hash: 41D19D75E0011A9FCB00EFA9D4919FEB7B5EF48300BD080B6E801A7245D638AD4ADB69
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00407748 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E00407748() {
				intOrPtr* _t14;
				void* _t23;
				void* _t26;
				intOrPtr _t34;
				intOrPtr* _t36;
				void* _t50;
				struct HINSTANCE__* _t53;
				void* _t62;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x4b7004 != 0) {
					E00407630();
					E004076B8(_t50);
					 *0x4b7004 = 0;
				}
				if( *0x4bdbcc != 0 && GetCurrentThreadId() ==  *0x4bdbf4) {
					E00407388(0x4bdbc8);
					E0040768C(0x4bdbc8);
				}
				if( *0x004BDBC0 != 0 ||  *0x4bb054 == 0) {
					L9:
					if( *((char*)(0x4bdbc0)) == 2 &&  *0x4b7000 == 0) {
						 *0x004BDBA4 = 0;
					}
					if( *((char*)(0x4bdbc0)) != 0) {
						L15:
						E004073B0();
						if( *((char*)(0x4bdbc0)) <= 1 ||  *0x4b7000 != 0) {
							_t18 =  *0x004BDBA8;
							if( *0x004BDBA8 != 0) {
								E0040B40C(_t18);
								_t34 =  *((intOrPtr*)(0x4bdba8));
								_t8 = _t34 + 0x10; // 0x400000
								_t53 =  *_t8;
								_t9 = _t34 + 4; // 0x400000
								if(_t53 !=  *_t9 && _t53 != 0) {
									FreeLibrary(_t53);
								}
							}
						}
						E00407388(0x4bdb98);
						if( *((char*)(0x4bdbc0)) == 1) {
							 *0x004BDBBC();
						}
						if( *((char*)(0x4bdbc0)) != 0) {
							E0040768C(0x4bdb98);
						}
						if( *0x4bdb98 == 0) {
							if( *0x4bb038 != 0) {
								 *0x4bb038();
							}
							ExitProcess( *0x4b7000);
						}
						memcpy(0x4bdb98,  *0x4bdb98, 0xc << 2);
						_t62 = _t62 + 0xc;
						0x4b7000 = 0x4b7000;
						0x4bdb98 = 0x4bdb98;
						goto L9;
					} else {
						_t23 = E004054B4();
						_t48 = _t23;
						if(_t23 == 0) {
							goto L15;
						} else {
							goto L14;
						}
						do {
							L14:
							E00405CE8(_t48);
							_t26 = E004054B4();
							_t48 = _t26;
						} while (_t26 != 0);
						goto L15;
					}
				} else {
					do {
						_t36 =  *0x4bb054; // 0x0
						 *0x4bb054 = 0;
						 *_t36();
					} while ( *0x4bb054 != 0);
					L9:
					while(1) {
					}
				}
			}











                                                                                          0x0040774a
                                                                                          0x00407764
                                                                                          0x00407766
                                                                                          0x0040776b
                                                                                          0x00407772
                                                                                          0x00407772
                                                                                          0x0040777e
                                                                                          0x00407792
                                                                                          0x0040779c
                                                                                          0x0040779c
                                                                                          0x004077a5
                                                                                          0x004077c9
                                                                                          0x004077cd
                                                                                          0x004077d6
                                                                                          0x004077d6
                                                                                          0x004077dd
                                                                                          0x004077fc
                                                                                          0x004077fc
                                                                                          0x00407805
                                                                                          0x0040780c
                                                                                          0x00407811
                                                                                          0x00407813
                                                                                          0x00407818
                                                                                          0x0040781b
                                                                                          0x0040781b
                                                                                          0x0040781e
                                                                                          0x00407821
                                                                                          0x00407828
                                                                                          0x00407828
                                                                                          0x00407821
                                                                                          0x00407811
                                                                                          0x0040782f
                                                                                          0x00407838
                                                                                          0x0040783a
                                                                                          0x0040783a
                                                                                          0x00407841
                                                                                          0x00407845
                                                                                          0x00407845
                                                                                          0x0040784d
                                                                                          0x00407856
                                                                                          0x00407858
                                                                                          0x00407858
                                                                                          0x00407861
                                                                                          0x00407861
                                                                                          0x00407873
                                                                                          0x00407873
                                                                                          0x00407875
                                                                                          0x00407876
                                                                                          0x00000000
                                                                                          0x004077df
                                                                                          0x004077df
                                                                                          0x004077e4
                                                                                          0x004077e8
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004077ea
                                                                                          0x004077ea
                                                                                          0x004077ec
                                                                                          0x004077f1
                                                                                          0x004077f6
                                                                                          0x004077f8
                                                                                          0x00000000
                                                                                          0x004077ea
                                                                                          0x004077b0
                                                                                          0x004077b0
                                                                                          0x004077b0
                                                                                          0x004077b9
                                                                                          0x004077be
                                                                                          0x004077c0
                                                                                          0x00000000
                                                                                          0x004077c9
                                                                                          0x00000000
                                                                                          0x004077c9

                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00407780
                                                                                          • FreeLibrary.KERNEL32(00400000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407828
                                                                                          • ExitProcess.KERNEL32(00000000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407861
                                                                                            • Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
                                                                                            • Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
                                                                                            • Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
                                                                                            • Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
                                                                                          • String ID: MZP
                                                                                          • API String ID: 3490077880-2889622443
                                                                                          • Opcode ID: a9f8d515380474a460b33ab06d945397efae342618a5e5be82eb265a6d75249a
                                                                                          • Instruction ID: d27a77ceaac24130fd240bd57b6351079d7b86260851eacd1cc0dabcd71a23ca
                                                                                          • Opcode Fuzzy Hash: a9f8d515380474a460b33ab06d945397efae342618a5e5be82eb265a6d75249a
                                                                                          • Instruction Fuzzy Hash: BC317E20E087415BE721BB7A888835B7BE09B45315F14897BE541A72D2D77CB884CB6F
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00407750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E00407750() {
				void* _t20;
				void* _t23;
				intOrPtr _t31;
				intOrPtr* _t33;
				void* _t46;
				struct HINSTANCE__* _t49;
				void* _t56;

				if( *0x4b7004 != 0) {
					E00407630();
					E004076B8(_t46);
					 *0x4b7004 = 0;
				}
				if( *0x4bdbcc != 0 && GetCurrentThreadId() ==  *0x4bdbf4) {
					E00407388(0x4bdbc8);
					E0040768C(0x4bdbc8);
				}
				if( *0x004BDBC0 != 0 ||  *0x4bb054 == 0) {
					L8:
					if( *((char*)(0x4bdbc0)) == 2 &&  *0x4b7000 == 0) {
						 *0x004BDBA4 = 0;
					}
					if( *((char*)(0x4bdbc0)) != 0) {
						L14:
						E004073B0();
						if( *((char*)(0x4bdbc0)) <= 1 ||  *0x4b7000 != 0) {
							_t15 =  *0x004BDBA8;
							if( *0x004BDBA8 != 0) {
								E0040B40C(_t15);
								_t31 =  *((intOrPtr*)(0x4bdba8));
								_t8 = _t31 + 0x10; // 0x400000
								_t49 =  *_t8;
								_t9 = _t31 + 4; // 0x400000
								if(_t49 !=  *_t9 && _t49 != 0) {
									FreeLibrary(_t49);
								}
							}
						}
						E00407388(0x4bdb98);
						if( *((char*)(0x4bdbc0)) == 1) {
							 *0x004BDBBC();
						}
						if( *((char*)(0x4bdbc0)) != 0) {
							E0040768C(0x4bdb98);
						}
						if( *0x4bdb98 == 0) {
							if( *0x4bb038 != 0) {
								 *0x4bb038();
							}
							ExitProcess( *0x4b7000);
						}
						memcpy(0x4bdb98,  *0x4bdb98, 0xc << 2);
						_t56 = _t56 + 0xc;
						0x4b7000 = 0x4b7000;
						0x4bdb98 = 0x4bdb98;
						goto L8;
					} else {
						_t20 = E004054B4();
						_t44 = _t20;
						if(_t20 == 0) {
							goto L14;
						} else {
							goto L13;
						}
						do {
							L13:
							E00405CE8(_t44);
							_t23 = E004054B4();
							_t44 = _t23;
						} while (_t23 != 0);
						goto L14;
					}
				} else {
					do {
						_t33 =  *0x4bb054; // 0x0
						 *0x4bb054 = 0;
						 *_t33();
					} while ( *0x4bb054 != 0);
					L8:
					while(1) {
					}
				}
			}










                                                                                          0x00407764
                                                                                          0x00407766
                                                                                          0x0040776b
                                                                                          0x00407772
                                                                                          0x00407772
                                                                                          0x0040777e
                                                                                          0x00407792
                                                                                          0x0040779c
                                                                                          0x0040779c
                                                                                          0x004077a5
                                                                                          0x004077c9
                                                                                          0x004077cd
                                                                                          0x004077d6
                                                                                          0x004077d6
                                                                                          0x004077dd
                                                                                          0x004077fc
                                                                                          0x004077fc
                                                                                          0x00407805
                                                                                          0x0040780c
                                                                                          0x00407811
                                                                                          0x00407813
                                                                                          0x00407818
                                                                                          0x0040781b
                                                                                          0x0040781b
                                                                                          0x0040781e
                                                                                          0x00407821
                                                                                          0x00407828
                                                                                          0x00407828
                                                                                          0x00407821
                                                                                          0x00407811
                                                                                          0x0040782f
                                                                                          0x00407838
                                                                                          0x0040783a
                                                                                          0x0040783a
                                                                                          0x00407841
                                                                                          0x00407845
                                                                                          0x00407845
                                                                                          0x0040784d
                                                                                          0x00407856
                                                                                          0x00407858
                                                                                          0x00407858
                                                                                          0x00407861
                                                                                          0x00407861
                                                                                          0x00407873
                                                                                          0x00407873
                                                                                          0x00407875
                                                                                          0x00407876
                                                                                          0x00000000
                                                                                          0x004077df
                                                                                          0x004077df
                                                                                          0x004077e4
                                                                                          0x004077e8
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004077ea
                                                                                          0x004077ea
                                                                                          0x004077ec
                                                                                          0x004077f1
                                                                                          0x004077f6
                                                                                          0x004077f8
                                                                                          0x00000000
                                                                                          0x004077ea
                                                                                          0x004077b0
                                                                                          0x004077b0
                                                                                          0x004077b0
                                                                                          0x004077b9
                                                                                          0x004077be
                                                                                          0x004077c0
                                                                                          0x00000000
                                                                                          0x004077c9
                                                                                          0x00000000
                                                                                          0x004077c9

                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00407780
                                                                                          • FreeLibrary.KERNEL32(00400000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407828
                                                                                          • ExitProcess.KERNEL32(00000000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407861
                                                                                            • Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
                                                                                            • Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
                                                                                            • Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
                                                                                            • Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
                                                                                          • String ID: MZP
                                                                                          • API String ID: 3490077880-2889622443
                                                                                          • Opcode ID: 1ba9ccdc5e5ec41ea7066db700fb32a50d39e50ecd0d58aa72eac7c5645d258d
                                                                                          • Instruction ID: 4bb8ca2865ae45d0ec72c9e6ca862cba493d08d50c1d65b63798a8296780cd14
                                                                                          • Opcode Fuzzy Hash: 1ba9ccdc5e5ec41ea7066db700fb32a50d39e50ecd0d58aa72eac7c5645d258d
                                                                                          • Instruction Fuzzy Hash: 76317220E087415BE721BB7A888875B76E09B45315F14897FE541A33D2D77CB884CB6F
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0041C790 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 75%
                                                                                          			E0041C790(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				short _v536;
				short* _t32;
				intOrPtr* _t47;
				intOrPtr _t56;
				void* _t61;
				intOrPtr _t63;
				void* _t67;

				_v8 = 0;
				_t47 = __edx;
				_t61 = __eax;
				_push(_t67);
				_push(0x41c873);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				E00407A20(__edx);
				_v24 =  *(_a4 - 2) & 0x0000ffff;
				_v22 =  *(_a4 - 4) & 0x0000ffff;
				_v18 =  *(_a4 - 6) & 0x0000ffff;
				if(_t61 > 2) {
					E00407E48( &_v8, L"yyyy");
				} else {
					E00407E48( &_v8, 0x41c88c);
				}
				_t32 = E004084EC(_v8);
				if(GetDateFormatW(GetThreadLocale(), 4,  &_v24, _t32,  &_v536, 0x200) != 0) {
					E0040858C(_t47, 0x100,  &_v536);
					if(_t61 == 1 &&  *((short*)( *_t47)) == 0x30) {
						_t63 =  *_t47;
						if(_t63 != 0) {
							_t63 =  *((intOrPtr*)(_t63 - 4));
						}
						E004088AC( *_t47, _t63 - 1, 2, _t47);
					}
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41c87a);
				return E00407A20( &_v8);
			}














                                                                                          0x0041c79d
                                                                                          0x0041c7a0
                                                                                          0x0041c7a2
                                                                                          0x0041c7a6
                                                                                          0x0041c7a7
                                                                                          0x0041c7ac
                                                                                          0x0041c7af
                                                                                          0x0041c7b4
                                                                                          0x0041c7c0
                                                                                          0x0041c7cb
                                                                                          0x0041c7d6
                                                                                          0x0041c7dd
                                                                                          0x0041c7f6
                                                                                          0x0041c7df
                                                                                          0x0041c7e7
                                                                                          0x0041c7e7
                                                                                          0x0041c80a
                                                                                          0x0041c823
                                                                                          0x0041c832
                                                                                          0x0041c838
                                                                                          0x0041c842
                                                                                          0x0041c846
                                                                                          0x0041c84b
                                                                                          0x0041c84b
                                                                                          0x0041c858
                                                                                          0x0041c858
                                                                                          0x0041c838
                                                                                          0x0041c85f
                                                                                          0x0041c862
                                                                                          0x0041c865
                                                                                          0x0041c872

                                                                                          APIs
                                                                                          • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,0041C873), ref: 0041C816
                                                                                          • GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,0041C873), ref: 0041C81C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DateFormatLocaleThread
                                                                                          • String ID: $yyyy
                                                                                          • API String ID: 3303714858-404527807
                                                                                          • Opcode ID: 9b84cafd13c5b3a76178dd7a5deb0e6d63fe676c73d736d950a9ec0585647aa0
                                                                                          • Instruction ID: d4c72dfe3e93bc103dd676e1b73ac12d517b544291048ec360f079cc1ca068dc
                                                                                          • Opcode Fuzzy Hash: 9b84cafd13c5b3a76178dd7a5deb0e6d63fe676c73d736d950a9ec0585647aa0
                                                                                          • Instruction Fuzzy Hash: 9A215335A442189BDB11EF95CDC1AAEB3B8EF08701F5144BBFC45E7281D7789E4087AA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040A6C8 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E0040A6C8(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x4bdc08()) {
					_v16 = E0040A684( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x4bdc04(4,  &_v32,  &_v20);
				}
				_t39 = E0040A684( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E00408550(_t81, _t67);
					_t39 = E0040540C(_t67);
				}
				if(_v16 != 0) {
					 *0x4bdc04(0, 0,  &_v20);
					_t68 = E0040A684( &_v12);
					if(_v8 != _v12 || E0040A660(_v16, _v12, _t68) != 0) {
						 *0x4bdc04(8, _v16,  &_v20);
					}
					E0040540C(_t68);
					return E0040540C(_v16);
				}
				return _t39;
			}





















                                                                                          0x0040a6d0
                                                                                          0x0040a6d2
                                                                                          0x0040a6d6
                                                                                          0x0040a6e2
                                                                                          0x0040a6ec
                                                                                          0x0040a6ef
                                                                                          0x0040a6f1
                                                                                          0x0040a6f8
                                                                                          0x0040a6fb
                                                                                          0x0040a70c
                                                                                          0x0040a712
                                                                                          0x0040a715
                                                                                          0x0040a718
                                                                                          0x0040a71b
                                                                                          0x0040a721
                                                                                          0x0040a727
                                                                                          0x0040a737
                                                                                          0x0040a737
                                                                                          0x0040a740
                                                                                          0x0040a745
                                                                                          0x0040a749
                                                                                          0x0040a74e
                                                                                          0x0040a753
                                                                                          0x0040a755
                                                                                          0x0040a756
                                                                                          0x0040a75d
                                                                                          0x0040a765
                                                                                          0x0040a76a
                                                                                          0x0040a76a
                                                                                          0x0040a770
                                                                                          0x0040a773
                                                                                          0x0040a773
                                                                                          0x0040a75d
                                                                                          0x0040a77a
                                                                                          0x0040a781
                                                                                          0x0040a781
                                                                                          0x0040a78a
                                                                                          0x0040a794
                                                                                          0x0040a7a2
                                                                                          0x0040a7aa
                                                                                          0x0040a7c7
                                                                                          0x0040a7c7
                                                                                          0x0040a7cf
                                                                                          0x00000000
                                                                                          0x0040a7d7
                                                                                          0x0040a7e1

                                                                                          APIs
                                                                                          • GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040A6D9
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040A737
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040A794
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040A7C7
                                                                                            • Part of subcall function 0040A684: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040A745), ref: 0040A69B
                                                                                            • Part of subcall function 0040A684: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040A745), ref: 0040A6B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$LanguagesPreferred$Language
                                                                                          • String ID:
                                                                                          • API String ID: 2255706666-0
                                                                                          • Opcode ID: 4c514f641868e752fd40307e4922e2f5a84495159d338bc2b006041d37f1dfb0
                                                                                          • Instruction ID: 64ac70e7ec2a8712ea9b0e83aabe60772fb1db60419ab041f5eb1837937ee239
                                                                                          • Opcode Fuzzy Hash: 4c514f641868e752fd40307e4922e2f5a84495159d338bc2b006041d37f1dfb0
                                                                                          • Instruction Fuzzy Hash: 97317070E0021A9BDB10DFA9C884AAFB7B8EF04304F00867AE555E7291EB789E05CB55
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00420BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00420BD8() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E0040E1A8(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x4b7e30 = _t1;
				}
				if( *0x4b7e30 == 0) {
					 *0x4b7e30 = E0041A4DC;
					return E0041A4DC;
				}
				return _t1;
			}






                                                                                          0x00420bde
                                                                                          0x00420be3
                                                                                          0x00420be7
                                                                                          0x00420bef
                                                                                          0x00420bf4
                                                                                          0x00420bf4
                                                                                          0x00420c00
                                                                                          0x00420c07
                                                                                          0x00000000
                                                                                          0x00420c07
                                                                                          0x00420c0d

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,?,00420CB4,00000000,00420CCC,?,?,00420C69), ref: 00420BDE
                                                                                            • Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: GetDiskFreeSpaceExW$kernel32.dll
                                                                                          • API String ID: 1646373207-1127948838
                                                                                          • Opcode ID: f76785e0005e833dd4a9f921d8d2e36157eed1af70da7a881872f52b203e86d0
                                                                                          • Instruction ID: d69f2d486575a746b5ffe9d6a82661523d0842203aaa5c8b8dd0cb43f1f92830
                                                                                          • Opcode Fuzzy Hash: f76785e0005e833dd4a9f921d8d2e36157eed1af70da7a881872f52b203e86d0
                                                                                          • Instruction Fuzzy Hash: 31D05EB03143165FE7056BB2ACC561636C6AB86304B900B7BA5046A243CBFDDC50434C
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004AF1B4 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004AF1B4(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00427154(_t9, _v8, _t19);
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}










                                                                                          0x004af1b4
                                                                                          0x004af1bb
                                                                                          0x004af1be
                                                                                          0x004af1c2
                                                                                          0x004af1c5
                                                                                          0x004af213
                                                                                          0x004af213
                                                                                          0x004af213
                                                                                          0x004af1c7
                                                                                          0x004af1c8
                                                                                          0x004af1ca
                                                                                          0x004af1ca
                                                                                          0x004af1cd
                                                                                          0x004af1da
                                                                                          0x004af1dd
                                                                                          0x004af1e3
                                                                                          0x004af1e3
                                                                                          0x004af1cf
                                                                                          0x004af1d3
                                                                                          0x004af1d3
                                                                                          0x004af1ed
                                                                                          0x004af1f4
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af1f6
                                                                                          0x004af1fe
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af200
                                                                                          0x004af208
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af20a
                                                                                          0x004af20b
                                                                                          0x004af20c
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004af20c
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1D3
                                                                                          • Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1E3
                                                                                          • GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1F6
                                                                                          • GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF200
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.509094370.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000006.00000002.509085103.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510254400.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510347221.00000000004C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510389647.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000006.00000002.510410414.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastSleep
                                                                                          • String ID:
                                                                                          • API String ID: 1458359878-0
                                                                                          • Opcode ID: 132a67e1d44d9774a6928004e5d8cee8820d44842addde93f31c36794548402b
                                                                                          • Instruction ID: c6a2870ed3ca6a3ef6dac7de38143878fdab2d33d6efdb0808b7300bb595a527
                                                                                          • Opcode Fuzzy Hash: 132a67e1d44d9774a6928004e5d8cee8820d44842addde93f31c36794548402b
                                                                                          • Instruction Fuzzy Hash: 0CF02B37B04224A76724A5EBEC46D6FE298DEB33A8710457BFC04D7302C439CC4542A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Execution Graph

                                                                                          Execution Coverage:10.8%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:2.7%
                                                                                          Total number of Nodes:1050
                                                                                          Total number of Limit Nodes:75
                                                                                          execution_graph 21661 42b8a3 SetErrorMode 21662 423a20 21671 40b278 21662->21671 21665 423a75 21666 423a3f GetLastError GetFileAttributesW 21667 423a51 21666->21667 21668 423a6f SetLastError 21666->21668 21667->21668 21669 423a5a 21667->21669 21668->21665 21670 423a61 RemoveDirectoryW 21669->21670 21670->21665 21672 40b27e DeleteFileW 21671->21672 21672->21665 21672->21666 21673 405a04 21674 405c64 21673->21674 21675 405a1c 21673->21675 21676 405d7c 21674->21676 21677 405c28 21674->21677 21685 405a2e 21675->21685 21688 405ab9 Sleep 21675->21688 21678 4057b0 VirtualAlloc 21676->21678 21679 405d85 21676->21679 21683 405c42 Sleep 21677->21683 21689 405c82 21677->21689 21681 4057eb 21678->21681 21682 4057db 21678->21682 21680 405a3d 21697 405764 Sleep Sleep 21682->21697 21687 405c58 Sleep 21683->21687 21683->21689 21685->21680 21686 405b1c 21685->21686 21691 405afd Sleep 21685->21691 21696 405b28 21686->21696 21698 4056e8 21686->21698 21687->21677 21688->21685 21690 405acf Sleep 21688->21690 21692 4056e8 VirtualAlloc 21689->21692 21693 405ca0 21689->21693 21690->21675 21691->21686 21695 405b13 Sleep 21691->21695 21692->21693 21695->21685 21697->21681 21702 40567c 21698->21702 21700 4056f1 VirtualAlloc 21701 405708 21700->21701 21701->21696 21703 40561c 21702->21703 21703->21700 21704 5b85f0 PeekMessageW 21705 5b8611 21704->21705 21710 5b86f2 21704->21710 21706 5b8617 IsWindowUnicode 21705->21706 21707 5b8621 21705->21707 21706->21707 21708 5b8648 PeekMessageA 21707->21708 21709 5b8632 PeekMessageW 21707->21709 21711 5b865c 21708->21711 21709->21711 21711->21710 21725 5ba368 GetCapture 21711->21725 21713 5b8697 21713->21710 21732 5b8488 21713->21732 21722 5b86d5 TranslateMessage 21723 5b86ea DispatchMessageA 21722->21723 21724 5b86e2 DispatchMessageW 21722->21724 21723->21710 21724->21710 21726 5ba37d 21725->21726 21730 5ba38f 21725->21730 21726->21730 21760 50e958 7 API calls 21726->21760 21728 5ba39a 21729 5ba3a0 GetParent 21728->21729 21728->21730 21761 50e958 7 API calls 21728->21761 21729->21728 21729->21730 21730->21713 21733 5b849c 21732->21733 21734 5b84b3 21732->21734 21733->21734 21762 5b9948 157 API calls 21733->21762 21734->21710 21736 5b8340 21734->21736 21737 5b838a 21736->21737 21738 5b8350 21736->21738 21737->21710 21740 5b8390 21737->21740 21738->21737 21739 5b8377 TranslateMDISysAccel 21738->21739 21739->21737 21741 5b83ab 21740->21741 21742 5b847e 21740->21742 21741->21742 21743 5b83b6 GetCapture 21741->21743 21742->21710 21755 5b82f8 21742->21755 21744 5b83c1 21743->21744 21745 5b8440 GetWindowThreadProcessId GetWindowThreadProcessId 21743->21745 21749 5b83f2 21744->21749 21751 5b83db GetParent 21744->21751 21752 5b83d2 21744->21752 21763 50e9b4 7 API calls 21744->21763 21745->21742 21746 5b8461 SendMessageW 21745->21746 21746->21742 21747 5b841d 21746->21747 21747->21742 21750 5b83f8 IsWindowUnicode 21749->21750 21749->21752 21753 5b8402 SendMessageW 21750->21753 21754 5b8421 SendMessageA 21750->21754 21751->21744 21752->21750 21753->21742 21753->21747 21754->21742 21754->21747 21756 5b8309 IsWindowUnicode 21755->21756 21757 5b833d 21755->21757 21758 5b832a IsDialogMessageA 21756->21758 21759 5b8315 IsDialogMessageW 21756->21759 21757->21710 21757->21722 21758->21757 21759->21757 21760->21728 21761->21728 21762->21734 21763->21744 21764 6c4660 21776 410ba8 GetModuleHandleW 21764->21776 21770 6c46d5 21787 6b9870 21770->21787 21772 6c46e7 21811 5b8250 21772->21811 21774 6c471b ShowWindow 21775 6c4767 21774->21775 21777 410be3 21776->21777 21817 409c2c 21777->21817 21780 6b9800 GetModuleHandleW 21827 414020 21780->21827 21782 6b9815 21783 5b8740 21782->21783 21784 5b874f 21783->21784 21786 5b876c 21783->21786 21785 5b8759 SendMessageW 21784->21785 21784->21786 21785->21786 21786->21770 21833 610358 GetModuleFileNameW GetCommandLineW 21787->21833 21789 6b989e 21792 6b99a8 21789->21792 21834 5c6f50 GetCommandLineW 21789->21834 21791 6b98bc 21793 6b990d 21791->21793 21810 6b98c2 21791->21810 21792->21772 21794 6b999c 21793->21794 21795 6b9917 21793->21795 21796 6b99aa 21794->21796 21797 6b99a4 21794->21797 21839 5c6fb0 GetModuleFileNameW GetCommandLineW 21795->21839 21841 6b8998 129 API calls 21796->21841 21797->21792 21800 6b99cb 21797->21800 21799 5c6fb0 GetModuleFileNameW GetCommandLineW 21799->21810 21842 6b9138 278 API calls 21800->21842 21802 6b9927 21835 5cbfb8 21802->21835 21805 6b9936 21840 5cbf50 99 API calls 21805->21840 21806 6b99bf 21806->21792 21807 6b98e2 21807->21793 21809 6b9964 21809->21772 21810->21793 21810->21799 21810->21807 21813 5b8264 21811->21813 21812 5b829c 21812->21774 21813->21812 21814 5b8278 SetWindowTextW 21813->21814 21815 5b8288 21813->21815 21814->21812 21816 5b8295 SetWindowTextW 21815->21816 21816->21812 21818 409c64 21817->21818 21821 409bc0 21818->21821 21822 409c08 GetWindowLongW SetWindowLongW SetErrorMode 21821->21822 21823 409bd0 21821->21823 21822->21780 21823->21822 21825 5c857c FormatMessageW 21823->21825 21826 5c85a2 21825->21826 21826->21823 21828 414048 GetProcAddress 21827->21828 21830 414054 21827->21830 21829 4140a8 21828->21829 21829->21782 21831 414081 GetProcAddress 21830->21831 21832 4140a0 21831->21832 21832->21782 21833->21789 21834->21791 21836 5cbfc2 21835->21836 21838 5cc007 21836->21838 21843 5cbf3c 100 API calls 21836->21843 21838->21805 21839->21802 21840->21809 21841->21806 21842->21806 21843->21838 21844 6a3564 21845 6a34e7 21844->21845 21847 6a3570 21844->21847 21851 6a27e4 21845->21851 21848 6a3516 21856 6a25e8 98 API calls 21848->21856 21850 6a3547 21852 6a293b 21851->21852 21854 6a27fe 21851->21854 21852->21848 21854->21852 21857 40a1a8 SysAllocStringLen SysFreeString SysReAllocStringLen 21854->21857 21858 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21854->21858 21856->21850 21857->21854 21859 60c2b0 21866 60bf74 21859->21866 21861 60c2c9 21862 60c2cd 21861->21862 21863 60c2ec FindFirstFileW GetLastError 21861->21863 21872 60bfb0 21863->21872 21867 60bf82 21866->21867 21868 60bf7e 21866->21868 21869 60bfa4 SetLastError 21867->21869 21870 60bf8b Wow64DisableWow64FsRedirection 21867->21870 21868->21861 21871 60bf9f 21869->21871 21870->21871 21871->21861 21873 60bfb5 Wow64RevertWow64FsRedirection 21872->21873 21874 60bfbf 21872->21874 21873->21874 21875 517b00 21876 517b2f 21875->21876 21881 510694 110 API calls 21876->21881 21878 517b41 21882 4f1b90 112 API calls 21878->21882 21880 517b46 21881->21878 21882->21880 21883 6ae698 21888 610424 52 API calls 21883->21888 21885 6ae6b8 21889 6ae3c8 21885->21889 21888->21885 21890 6ae3da 21889->21890 21891 6ae61d 21889->21891 21907 464cd0 21890->21907 21893 6ae3e6 21911 5cd600 21893->21911 21895 6ae404 21921 40bfac 21895->21921 21899 6ae454 21901 6ae476 21899->21901 21934 5c7f8c GetDC 21899->21934 21902 5b8250 2 API calls 21901->21902 21906 6ae58a 21902->21906 21903 6ae5fe 21903->21891 21904 6ae607 SendNotifyMessageW 21903->21904 21904->21891 21905 464cd0 98 API calls 21905->21906 21906->21903 21906->21905 21908 464cec 21907->21908 21909 464cdd 21907->21909 21908->21893 21937 464c44 98 API calls 21909->21937 21912 5cd60e 21911->21912 21914 5cd627 21912->21914 21938 5cd54c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21912->21938 21916 5cd649 21914->21916 21939 5cd54c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21914->21939 21919 5cd67f 21916->21919 21940 5cd54c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21916->21940 21920 5cd6b5 21919->21920 21941 5cd54c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21919->21941 21920->21895 21922 40bfc2 21921->21922 21923 40bfdf 21921->21923 21922->21923 21924 40bfe1 21922->21924 21942 40c024 16 API calls 21922->21942 21927 40c278 21923->21927 21924->21923 21943 40fd04 14 API calls 21924->21943 21928 40c407 21927->21928 21931 40c29d 21927->21931 21928->21899 21931->21928 21933 40c278 47 API calls 21931->21933 21944 40a1a8 SysAllocStringLen SysFreeString SysReAllocStringLen 21931->21944 21945 40c654 47 API calls 21931->21945 21946 40fd30 44 API calls 21931->21946 21933->21931 21935 40b278 21934->21935 21936 5c7fc1 EnumFontsW ReleaseDC 21935->21936 21936->21901 21938->21914 21939->21916 21940->21919 21941->21919 21942->21922 21943->21924 21944->21931 21945->21931 21946->21931 21947 6b0178 21952 464f78 21947->21952 21949 6b01e4 21951 6b0199 21951->21949 21958 6a419c 21951->21958 21953 464f92 21952->21953 21954 464f83 21952->21954 21956 464fab 21953->21956 21967 40d208 21953->21967 21966 464c44 98 API calls 21954->21966 21956->21951 21961 6a4218 21958->21961 21963 6a41cd 21958->21963 21959 6a4265 21984 5cd324 21959->21984 21961->21959 21964 5cd324 99 API calls 21961->21964 21962 6a427d 21962->21951 21963->21961 21965 5cd324 99 API calls 21963->21965 21964->21961 21965->21963 21970 40cf60 21967->21970 21969 40d212 21969->21956 21971 40cf9e 21970->21971 21974 40cf83 21970->21974 21972 40d00c 21971->21972 21975 40d0d9 21971->21975 21980 40d073 21972->21980 21981 40cf1c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21972->21981 21974->21969 21975->21980 21983 40c894 47 API calls 21975->21983 21976 40cf60 52 API calls 21976->21980 21978 40d024 21978->21980 21982 40c76c 48 API calls 21978->21982 21980->21974 21980->21976 21981->21978 21982->21980 21983->21980 21985 5cd33f 21984->21985 21986 5cd334 21984->21986 21990 5cd2c8 99 API calls 21985->21990 21986->21962 21988 5cd34a 21988->21986 21991 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 21988->21991 21990->21988 21992 6acffc 21993 6ad04f 21992->21993 21994 6ad036 21992->21994 21996 6ace44 21994->21996 21997 6ace74 21996->21997 21998 6acf09 21997->21998 21999 6aced3 21997->21999 22007 6163b4 105 API calls 21998->22007 22003 5c52c8 21999->22003 22002 6acefa 22002->21993 22004 5c52d1 22003->22004 22004->22004 22005 5c52f8 GetFullPathNameW 22004->22005 22006 5c5304 22005->22006 22006->22002 22007->22002 22008 5c7f24 22011 5c7ce0 22008->22011 22010 5c7f2e 22035 429d18 22011->22035 22014 5c7cfd AllocateAndInitializeSid 22015 5c7d2f GetVersion 22014->22015 22031 5c7cf4 22014->22031 22016 5c7d4f GetModuleHandleW 22015->22016 22017 5c7d66 22015->22017 22018 414020 2 API calls 22016->22018 22019 5c7d8d GetCurrentThread OpenThreadToken 22017->22019 22020 5c7d6a CheckTokenMembership 22017->22020 22021 5c7d64 22018->22021 22024 5c7dde GetTokenInformation 22019->22024 22025 5c7da9 GetLastError 22019->22025 22022 5c7d7e 22020->22022 22023 5c7eb4 FreeSid 22020->22023 22021->22017 22022->22023 22023->22010 22026 5c7e08 GetLastError 22024->22026 22027 5c7e21 22024->22027 22028 5c7dbf GetCurrentProcess OpenProcessToken 22025->22028 22025->22031 22026->22027 22026->22031 22029 5c7e29 GetTokenInformation 22027->22029 22028->22024 22028->22031 22029->22031 22033 5c7e53 22029->22033 22030 5c7e84 22034 5c7ea3 CloseHandle 22030->22034 22031->22010 22032 5c7e60 EqualSid 22032->22033 22033->22030 22033->22032 22034->22010 22036 429d21 22035->22036 22037 429d26 22035->22037 22039 429cc8 38 API calls 22036->22039 22037->22014 22037->22031 22039->22037 22040 624e78 22041 624e8b 22040->22041 22042 624e9f 22040->22042 22041->22042 22064 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22041->22064 22048 5c92c8 22042->22048 22045 624eab 22065 624ba8 174 API calls 22045->22065 22047 624ec9 22049 5c92d4 22048->22049 22050 5c92f7 GetActiveWindow GetFocus 22049->22050 22066 5abb4c GetCurrentThreadId EnumThreadWindows 22050->22066 22053 5c932b 22055 5c93bd SetFocus 22053->22055 22068 414da0 22053->22068 22054 5c931b RegisterClassW 22054->22053 22056 5c93d9 22055->22056 22056->22045 22058 5c9363 22058->22055 22072 5b8044 22058->22072 22060 5c9396 22061 414da0 CreateWindowExW 22060->22061 22062 5c93ac 22061->22062 22062->22055 22063 5c93b5 ShowWindow 22062->22063 22063->22055 22064->22042 22065->22047 22067 5abbd4 22066->22067 22067->22053 22067->22054 22076 407404 22068->22076 22070 414db3 CreateWindowExW 22071 414ded 22070->22071 22071->22058 22073 5b8059 22072->22073 22075 5b8083 22072->22075 22074 5b8062 GetWindowTextW 22073->22074 22073->22075 22074->22075 22075->22060 22076->22070 22077 6b8af7 22078 6b8b12 22077->22078 22079 5b8250 2 API calls 22078->22079 22080 6b8bb9 22079->22080 22096 5c685c 22080->22096 22083 6b8bed 22084 6b8c06 22083->22084 22085 6b8bf6 22083->22085 22100 6b786c 22084->22100 22217 6b724c 100 API calls 22085->22217 22087 6b8be8 22216 428fdc 64 API calls 22087->22216 22091 6b8bfb 22092 6b8c04 22091->22092 22218 6b740c 140 API calls 22091->22218 22219 615560 GetWindowLongW DestroyWindow SendMessageW 22092->22219 22095 6b8c29 22097 40b278 22096->22097 22098 5c6866 GetFileAttributesW 22097->22098 22099 5c6871 22098->22099 22099->22083 22215 6b6874 125 API calls 22099->22215 22101 6b789f 22100->22101 22102 6b78bd 22101->22102 22103 6b78b6 22101->22103 22105 6b78fb 22102->22105 22220 6153ac SendMessageW 22102->22220 22391 6ae6f8 6 API calls 22103->22391 22107 6b7925 22105->22107 22108 6b791b 22105->22108 22109 6b7927 22105->22109 22233 616130 22107->22233 22392 615ef0 110 API calls 22108->22392 22393 6160d4 106 API calls 22109->22393 22113 6b7972 22114 616130 105 API calls 22113->22114 22115 6b798d 22114->22115 22116 616130 105 API calls 22115->22116 22117 6b79a8 22116->22117 22249 5c6e90 GetCommandLineW 22117->22249 22119 6b79b0 22120 616130 105 API calls 22119->22120 22121 6b79c8 22120->22121 22250 6ae8a8 105 API calls 22121->22250 22123 6b79cd 22251 6b7198 100 API calls 22123->22251 22125 6b79d4 22252 62c5d0 MultiByteToWideChar LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22125->22252 22127 6b7aa9 22253 6b7198 100 API calls 22127->22253 22128 6b7a00 22129 6b7a65 22128->22129 22394 6af190 125 API calls 22128->22394 22129->22127 22396 6af190 125 API calls 22129->22396 22131 6b7ac2 22254 629794 MultiByteToWideChar 22131->22254 22135 6b7a60 22395 428fdc 64 API calls 22135->22395 22136 6b7ae0 22141 6b7aee 22136->22141 22398 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22136->22398 22137 6b7aa4 22397 428fdc 64 API calls 22137->22397 22255 6af854 105 API calls 22141->22255 22143 6b7b25 22145 6b7b44 22143->22145 22399 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22143->22399 22256 6ac8cc 22145->22256 22147 6b7b59 22148 6b7c8e 22147->22148 22273 6ac23c 22147->22273 22149 6b7d1f 22148->22149 22328 6a3828 22148->22328 22153 6b7d5b 22149->22153 22404 6b6874 125 API calls 22149->22404 22152 6b7b68 22311 6acc08 22152->22311 22331 6b700c 98 API calls 22153->22331 22158 6b7d51 22158->22153 22405 428fdc 64 API calls 22158->22405 22159 616130 105 API calls 22161 6b7d1a 22159->22161 22403 428fdc 64 API calls 22161->22403 22164 6b7d99 22166 6b7d9b Sleep 22164->22166 22167 6b7db8 22164->22167 22408 5b8704 157 API calls 22166->22408 22409 5c8790 GetProcAddress GetProcAddress GetModuleHandleW GetModuleHandleW 22167->22409 22168 6b7d64 22168->22164 22332 6297dc 6 API calls 22168->22332 22406 6b6874 125 API calls 22168->22406 22407 428fdc 64 API calls 22168->22407 22172 6b7de9 22333 6b66a8 22172->22333 22175 6b7b6d 22400 6b7754 98 API calls 22175->22400 22177 6b7df7 GetTickCount 22341 62a5f4 22177->22341 22180 6b7bef 22401 6a30c8 MultiByteToWideChar DestroyIcon LoadCursorW LoadCursorW 22180->22401 22181 6b7e1b 22410 6163b4 105 API calls 22181->22410 22184 6b7bfb 22402 6a31c0 98 API calls 22184->22402 22186 6b7ed0 22411 6163b4 105 API calls 22186->22411 22188 6b7f22 22190 6b7f5a 22188->22190 22412 5b8704 157 API calls 22188->22412 22189 6b7e41 22189->22186 22192 6b7e8b 22189->22192 22193 6b7ef5 22189->22193 22413 6b700c 98 API calls 22190->22413 22195 6a3828 98 API calls 22192->22195 22196 616130 105 API calls 22193->22196 22194 6b7f37 GetTickCount 22194->22190 22197 6b7f46 MsgWaitForMultipleObjects 22194->22197 22198 6b7ebe 22195->22198 22196->22186 22197->22188 22198->22186 22201 616130 105 API calls 22198->22201 22200 6b7f79 22202 6b7fbb 22200->22202 22203 6b7f7f 22200->22203 22201->22186 22205 6b7fed 22202->22205 22415 6b6874 125 API calls 22202->22415 22204 6b7fb9 22203->22204 22414 6b6874 125 API calls 22203->22414 22416 6b700c 98 API calls 22204->22416 22205->22204 22208 616130 105 API calls 22205->22208 22208->22204 22210 6b800f 22211 6b80b0 22210->22211 22417 6a35c0 98 API calls 22210->22417 22418 5c8820 GetProcAddress GetProcAddress GetModuleHandleW 22211->22418 22214 6b80e5 22214->22092 22215->22087 22217->22091 22218->22092 22219->22095 22221 6153d5 22220->22221 22222 615408 22220->22222 22429 429044 98 API calls 22221->22429 22419 4785f8 GetClassInfoW 22222->22419 22225 615403 22430 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22225->22430 22228 615436 22232 615450 SendMessageW 22228->22232 22432 5c86e0 GetProcAddress GetProcAddress GetModuleHandleW GetModuleHandleW ChangeWindowMessageFilterEx 22228->22432 22229 61542c 22431 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22229->22431 22232->22105 22234 616162 22233->22234 22235 616278 22233->22235 22436 615dc8 GetSystemTimeAsFileTime FileTimeToSystemTime 22234->22436 22241 6162d2 22235->22241 22441 6158ac 40 API calls 22235->22441 22238 61616a 22437 4244f8 98 API calls 22238->22437 22240 6161db 22438 616120 100 API calls 22240->22438 22241->22113 22243 61626e 22440 616120 100 API calls 22243->22440 22244 616236 22244->22243 22439 616120 100 API calls 22244->22439 22246 6161e3 22246->22244 22248 616120 100 API calls 22246->22248 22248->22246 22249->22119 22250->22123 22251->22125 22252->22128 22253->22131 22254->22136 22255->22143 22257 6ac8d4 22256->22257 22257->22257 22442 60d530 22257->22442 22259 6ac8f3 22260 616130 105 API calls 22259->22260 22261 6ac91b 22260->22261 22263 6ac92f 22261->22263 22456 61583c 40 API calls 22261->22456 22264 6ac956 CreateDirectoryW 22263->22264 22265 6ac960 GetLastError 22264->22265 22266 6ac9c9 22264->22266 22267 6ac97a 22265->22267 22270 6ac9f2 22266->22270 22451 6ac874 22266->22451 22268 5c857c FormatMessageW 22267->22268 22271 6ac99e 22268->22271 22270->22147 22457 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22271->22457 22274 6ac244 22273->22274 22274->22274 22275 5c7430 GetWindowsDirectoryW 22274->22275 22276 6ac261 22275->22276 22570 5c745c GetSystemDirectoryW 22276->22570 22278 6ac276 22572 5c7488 22278->22572 22280 6ac28b 22577 5c7530 22280->22577 22282 6ac2a7 22283 429d18 38 API calls 22282->22283 22284 6ac2b9 22283->22284 22285 5c6d5c GetEnvironmentVariableW 22284->22285 22286 6ac2cb 22284->22286 22285->22286 22585 6ac0d0 22286->22585 22288 6ac32e 22289 6ac0d0 8 API calls 22288->22289 22290 6ac368 22289->22290 22291 6ac404 22290->22291 22292 6ac0d0 8 API calls 22290->22292 22293 6ac424 SHGetKnownFolderPath 22291->22293 22300 6ac51d 22291->22300 22301 6ac3b5 22292->22301 22294 6ac43e 22293->22294 22295 6ac477 SHGetKnownFolderPath 22293->22295 22299 6ac459 CoTaskMemFree 22294->22299 22296 6ac4ca SHGetKnownFolderPath 22295->22296 22297 6ac491 22295->22297 22298 6ac4e4 22296->22298 22296->22300 22305 6ac4ac CoTaskMemFree 22297->22305 22306 6ac4ff CoTaskMemFree 22298->22306 22299->22152 22592 6ac180 22300->22592 22302 6ac3d5 22301->22302 22601 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22301->22601 22303 6ac0d0 8 API calls 22302->22303 22309 6ac3e4 22303->22309 22305->22152 22306->22152 22308 6ac56b 22308->22152 22309->22291 22602 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22309->22602 22312 5c745c GetSystemDirectoryW 22311->22312 22313 6acc2c 22312->22313 22314 5c745c GetSystemDirectoryW 22313->22314 22315 6acc4f 22314->22315 22618 42b848 SetErrorMode 22315->22618 22317 6acc74 22318 42b848 2 API calls 22317->22318 22319 6acc81 22318->22319 22320 6accb4 22319->22320 22621 4244f8 98 API calls 22319->22621 22322 414020 2 API calls 22320->22322 22324 6accc4 22322->22324 22323 6accac 22622 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22323->22622 22326 6accda 22324->22326 22623 60cd28 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22324->22623 22326->22175 22624 6a35dc 22328->22624 22330 6a3846 22330->22149 22330->22159 22331->22168 22332->22168 22639 68de40 22333->22639 22335 6b6727 22339 6b675f 22335->22339 22652 5b3a80 104 API calls 22335->22652 22336 6b66bf 22336->22335 22651 6a35c0 98 API calls 22336->22651 22340 6b700c 98 API calls 22339->22340 22340->22177 22342 62a5fd 22341->22342 22343 616130 105 API calls 22342->22343 22344 62a63f 22343->22344 22345 5c745c GetSystemDirectoryW 22344->22345 22346 62a64a 22345->22346 22913 424020 22346->22913 22348 62b5c1 22350 62b5da 22348->22350 22351 62b5ca SHChangeNotify 22348->22351 22354 62b5e8 22350->22354 22951 610320 SendMessageTimeoutW 22350->22951 22351->22350 22359 62b5f7 22354->22359 22952 62a4c8 129 API calls 22354->22952 22357 62a655 22358 62aaeb 22357->22358 22363 6163b4 105 API calls 22357->22363 22381 5c6894 GetFileAttributesW 22357->22381 22386 616130 105 API calls 22357->22386 22387 62a995 22357->22387 22916 62a5a0 MultiByteToWideChar 22357->22916 22917 60f06c 22357->22917 22934 60c5f4 GetFileAttributesW Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection GetLastError 22357->22934 22365 62ad30 22358->22365 22366 62ac55 22358->22366 22936 62a5a0 MultiByteToWideChar 22358->22936 22937 629db4 115 API calls 22358->22937 22938 60c5f4 GetFileAttributesW Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection GetLastError 22358->22938 22939 629ebc 183 API calls 22358->22939 22940 62a14c 136 API calls 22358->22940 22943 62a360 121 API calls 22358->22943 22379 5c6880 GetFileAttributesW 22359->22379 22385 62b67b 22359->22385 22390 62b667 SHChangeNotify 22359->22390 22362 62ae57 22362->22365 22373 62aecd SHChangeNotify 22362->22373 22945 60dcc8 14 API calls 22362->22945 22363->22357 22365->22348 22365->22362 22369 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22365->22369 22372 6163b4 105 API calls 22365->22372 22384 629850 135 API calls 22365->22384 22944 62a5a0 MultiByteToWideChar 22365->22944 22946 629db4 115 API calls 22365->22946 22947 5c6cd4 WritePrivateProfileStringW WriteProfileStringW 22365->22947 22948 5c6b78 GetPrivateProfileStringW GetProfileStringW 22365->22948 22949 5c6d20 WritePrivateProfileStringW WriteProfileStringW 22365->22949 22950 4244f8 98 API calls 22365->22950 22941 6163b4 105 API calls 22366->22941 22942 610040 43 API calls 22366->22942 22369->22365 22372->22365 22373->22362 22379->22359 22381->22357 22384->22365 22385->22181 22386->22357 22387->22357 22389 6163b4 105 API calls 22387->22389 22935 60f338 7 API calls 22387->22935 22389->22387 22390->22359 22391->22102 22392->22107 22393->22107 22394->22135 22396->22137 22398->22141 22399->22145 22400->22180 22401->22184 22402->22148 22404->22158 22406->22168 22408->22164 22409->22172 22410->22189 22411->22188 22412->22194 22413->22200 22414->22204 22415->22205 22416->22210 22417->22211 22418->22214 22420 478628 22419->22420 22421 478651 22420->22421 22422 478647 RegisterClassW 22420->22422 22423 478636 UnregisterClassW 22420->22423 22424 414da0 CreateWindowExW 22421->22424 22422->22421 22423->22422 22425 47867f 22424->22425 22426 47869c 22425->22426 22433 47845c 22425->22433 22426->22228 22426->22229 22428 478693 SetWindowLongW 22428->22426 22429->22225 22431->22228 22432->22228 22434 47846c VirtualAlloc 22433->22434 22435 47849a 22433->22435 22434->22435 22435->22428 22436->22238 22437->22240 22438->22246 22439->22243 22440->22235 22441->22241 22445 60d538 22442->22445 22446 60d577 CreateDirectoryW 22445->22446 22449 5c857c FormatMessageW 22445->22449 22458 5c75e4 22445->22458 22477 60d294 22445->22477 22482 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22445->22482 22447 60d581 GetLastError 22446->22447 22448 60d5f7 22446->22448 22447->22445 22448->22259 22449->22445 22508 46a120 22451->22508 22453 6ac890 22512 6ac78c 22453->22512 22455 6ac8ab 22455->22270 22456->22263 22483 5c6d5c 22458->22483 22460 5c7608 22461 5c7614 22460->22461 22487 5c6880 22460->22487 22462 5c6d5c GetEnvironmentVariableW 22461->22462 22464 5c7661 22461->22464 22465 5c7624 22462->22465 22467 5c52c8 GetFullPathNameW 22464->22467 22466 5c7630 22465->22466 22468 5c6880 GetFileAttributesW 22465->22468 22466->22464 22469 429d18 38 API calls 22466->22469 22476 5c766b 22467->22476 22468->22466 22470 5c7639 22469->22470 22471 5c7656 22470->22471 22473 5c6d5c GetEnvironmentVariableW 22470->22473 22471->22464 22490 5c7430 GetWindowsDirectoryW 22471->22490 22474 5c764a 22473->22474 22474->22471 22475 5c6880 GetFileAttributesW 22474->22475 22475->22471 22476->22445 22478 60d2b8 22477->22478 22481 60d35a 22478->22481 22496 60c240 22478->22496 22504 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22478->22504 22481->22445 22485 5c6d6f 22483->22485 22484 5c6d8a GetEnvironmentVariableW 22484->22485 22486 5c6d96 22484->22486 22485->22484 22485->22486 22486->22460 22492 5c6808 22487->22492 22489 5c6885 22489->22461 22491 5c7451 22490->22491 22491->22464 22493 5c6828 22492->22493 22494 5c6830 GetFileAttributesW 22493->22494 22495 5c684d 22494->22495 22495->22489 22497 60bf74 2 API calls 22496->22497 22498 60c256 22497->22498 22499 60c25a 22498->22499 22505 5c6894 22498->22505 22499->22478 22502 60bfb0 Wow64RevertWow64FsRedirection 22503 60c295 22502->22503 22503->22478 22506 5c6808 GetFileAttributesW 22505->22506 22507 5c689e GetLastError 22506->22507 22507->22502 22509 46a12a 22508->22509 22515 46a218 FindResourceW 22509->22515 22511 46a15a 22511->22453 22527 469bf0 22512->22527 22514 6ac7c1 22514->22455 22516 46a244 LoadResource 22515->22516 22517 46a23d 22515->22517 22519 46a257 22516->22519 22520 46a25e SizeofResource LockResource 22516->22520 22525 46a178 98 API calls 22517->22525 22526 46a178 98 API calls 22519->22526 22523 46a27c 22520->22523 22521 46a243 22521->22516 22523->22511 22524 46a25d 22524->22520 22525->22521 22526->22524 22530 4698b8 22527->22530 22529 469c0a 22529->22514 22531 4698c1 22530->22531 22534 4698fc 22531->22534 22533 4698dd 22533->22529 22535 469917 22534->22535 22536 469944 22535->22536 22537 4699c2 22535->22537 22557 4236fc 22536->22557 22565 4236a4 CreateFileW 22537->22565 22540 4699cc 22545 4699c0 22540->22545 22566 423bd0 GetFullPathNameW GetFullPathNameW 22540->22566 22542 469961 22542->22545 22561 423bd0 GetFullPathNameW GetFullPathNameW 22542->22561 22543 4699e7 GetLastError 22567 427d54 FormatMessageW LocalFree 22543->22567 22545->22533 22547 469980 GetLastError 22562 427d54 FormatMessageW LocalFree 22547->22562 22548 469a00 22568 429100 98 API calls 22548->22568 22551 469999 22563 429100 98 API calls 22551->22563 22552 469a22 22569 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22552->22569 22555 4699bb 22564 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22555->22564 22558 423712 22557->22558 22559 42374a 22557->22559 22560 423744 CreateFileW 22558->22560 22559->22542 22560->22559 22561->22547 22562->22551 22563->22555 22565->22540 22566->22543 22567->22548 22568->22552 22571 5c747d 22570->22571 22571->22278 22603 40a1c8 22572->22603 22574 5c7498 GetModuleHandleW 22575 414020 2 API calls 22574->22575 22576 5c74ad 22575->22576 22576->22280 22578 5c754f GetVersion 22577->22578 22581 5c758b 22577->22581 22579 5c755f 22578->22579 22578->22581 22580 5c745c GetSystemDirectoryW 22579->22580 22582 5c7567 22580->22582 22581->22282 22583 5c52c8 GetFullPathNameW 22582->22583 22584 5c7589 22583->22584 22584->22581 22605 5c7a14 22585->22605 22587 6ac0f6 22588 6ac11c 22587->22588 22608 5c793c 22587->22608 22588->22288 22590 6ac106 22591 6ac111 RegCloseKey 22590->22591 22591->22588 22593 6ac18e 22592->22593 22594 5c7a14 RegOpenKeyExW 22593->22594 22595 6ac1b6 22594->22595 22596 6ac1e7 22595->22596 22597 5c793c 6 API calls 22595->22597 22596->22308 22598 6ac1cc 22597->22598 22599 5c793c 6 API calls 22598->22599 22600 6ac1de RegCloseKey 22599->22600 22600->22596 22601->22302 22602->22291 22604 40a1ce 22603->22604 22604->22574 22606 5c7a1f 22605->22606 22607 5c7a25 RegOpenKeyExW 22605->22607 22606->22607 22607->22587 22611 5c77f4 22608->22611 22610 5c7945 22610->22590 22612 5c781a RegQueryValueExW 22611->22612 22614 5c783d 22612->22614 22616 5c7857 22612->22616 22615 5c7892 RegQueryValueExW 22614->22615 22614->22616 22617 428ffc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22614->22617 22615->22612 22615->22616 22616->22610 22617->22614 22619 40b278 22618->22619 22620 42b880 LoadLibraryW 22619->22620 22620->22317 22621->22323 22622->22320 22623->22326 22625 6a35f7 22624->22625 22626 6a3622 22625->22626 22627 6a3737 22625->22627 22631 6a3643 22626->22631 22636 6a253c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22626->22636 22630 6a3744 22627->22630 22638 6a2554 98 API calls 22627->22638 22630->22330 22631->22630 22632 6a27e4 7 API calls 22631->22632 22633 6a369b 22632->22633 22637 6a25e8 98 API calls 22633->22637 22635 6a36dd 22635->22330 22636->22631 22637->22635 22638->22630 22640 68de4b 22639->22640 22653 5d064c 22640->22653 22642 68de6e 22657 5d0a74 22642->22657 22644 68de81 22671 4ee668 112 API calls 22644->22671 22646 68dea6 22672 608318 22646->22672 22648 68dee4 22649 608318 120 API calls 22648->22649 22650 68df0f 22648->22650 22649->22650 22650->22336 22651->22335 22652->22339 22654 5d0655 22653->22654 22688 5ad608 22654->22688 22656 5d0687 22656->22642 22851 5ce198 22657->22851 22659 5d0aa1 22879 5ce26c GetDC 22659->22879 22661 5d0abe 22662 5d0bb5 22661->22662 22884 5d10c4 99 API calls 22661->22884 22662->22644 22664 5d0ae8 22885 5d0564 99 API calls 22664->22885 22666 5d0b04 22886 5ce3fc 102 API calls 22666->22886 22668 5d0b26 MulDiv MulDiv 22670 5d0b7e 22668->22670 22670->22644 22671->22646 22673 608338 LoadImageW 22672->22673 22675 608396 LoadImageW 22673->22675 22677 6083ac 22673->22677 22675->22677 22676 60846c 22676->22648 22677->22676 22908 4f53ac GetIconInfo GetObjectW DeleteObject DeleteObject 22677->22908 22679 6083db 22909 5118b8 KiUserCallbackDispatcher 22679->22909 22681 6083ec 22911 4f32dc 107 API calls 22681->22911 22683 608409 22684 4eee3c 112 API calls 22683->22684 22685 608414 22684->22685 22912 4f32dc 107 API calls 22685->22912 22687 608442 22687->22648 22689 5ad61c 22688->22689 22703 5acbf4 22689->22703 22691 5ad75b 22691->22656 22692 5ad642 22692->22691 22707 4648c0 22692->22707 22695 5ad71d 22695->22656 22697 5ad6ec 22720 410300 64 API calls 22697->22720 22699 5ad709 22721 429044 98 API calls 22699->22721 22701 5ad718 22722 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22701->22722 22704 5acbfd 22703->22704 22723 515554 22704->22723 22706 5acc13 22706->22692 22708 4648d6 22707->22708 22709 46490b 22708->22709 22775 464728 99 API calls 22708->22775 22763 464834 22709->22763 22712 464926 22713 464943 22712->22713 22776 46478c 68 API calls 22712->22776 22715 46495b 22713->22715 22777 4647c4 68 API calls 22713->22777 22715->22695 22717 408344 22715->22717 22843 41029c 22717->22843 22720->22699 22721->22701 22724 51555e 22723->22724 22733 510e28 22724->22733 22726 515574 22727 47845c VirtualAlloc 22726->22727 22728 51557f 22727->22728 22739 4eec78 22728->22739 22730 515591 22743 4eee3c 22730->22743 22732 5155a3 22732->22706 22734 510e32 22733->22734 22747 475e7c 22734->22747 22736 510e48 22751 4ee010 22736->22751 22738 510e6a 22738->22726 22740 4eec7e 22739->22740 22741 4ed740 106 API calls 22740->22741 22742 4eeca2 22741->22742 22742->22730 22745 4eee4d 22743->22745 22744 4eee85 22744->22732 22745->22744 22762 4eedb8 112 API calls 22745->22762 22748 475e83 22747->22748 22749 475ea8 22748->22749 22755 4761bc 104 API calls 22748->22755 22749->22736 22752 4ee016 22751->22752 22756 4ed740 22752->22756 22754 4ee041 22754->22738 22755->22749 22757 4ed6cc 22756->22757 22758 4ed75c EnterCriticalSection 22757->22758 22759 47566c 104 API calls 22758->22759 22761 4ed783 22759->22761 22760 4ed816 LeaveCriticalSection 22760->22754 22761->22760 22762->22744 22764 464855 22763->22764 22774 464898 22763->22774 22765 464834 107 API calls 22764->22765 22764->22774 22766 46486d 22765->22766 22767 408344 MultiByteToWideChar 22766->22767 22768 46487a 22767->22768 22778 40d74c 22768->22778 22772 46488a 22786 45dcd4 22772->22786 22774->22712 22775->22709 22776->22713 22777->22715 22795 40d724 VirtualQuery 22778->22795 22781 40d79c 22782 40d7c9 22781->22782 22783 40d7aa 22781->22783 22782->22772 22783->22782 22797 40d754 22783->22797 22787 45dce5 22786->22787 22788 45dcf4 FindResourceW 22787->22788 22789 45dd04 22788->22789 22790 45dd51 22788->22790 22791 46a120 102 API calls 22789->22791 22790->22774 22792 45dd15 22791->22792 22807 46970c 22792->22807 22794 45dd30 22794->22774 22796 40d73e 22795->22796 22796->22781 22798 40d764 GetModuleFileNameW 22797->22798 22799 40d780 22797->22799 22801 40e9e0 GetModuleFileNameW 22798->22801 22799->22772 22802 40ea2e 22801->22802 22803 40e8bc 60 API calls 22802->22803 22804 40ea5a 22803->22804 22805 40ea6c LoadLibraryExW 22804->22805 22806 40ea74 22804->22806 22805->22806 22806->22799 22812 46a2ec 22807->22812 22809 469728 22816 46e33c 22809->22816 22811 469743 22811->22794 22813 46a2f7 22812->22813 22814 40d208 52 API calls 22813->22814 22815 46a32c 22814->22815 22815->22809 22817 46e750 64 API calls 22816->22817 22818 46e375 22817->22818 22819 46e3b4 22818->22819 22820 46e3e9 22818->22820 22822 46e774 100 API calls 22819->22822 22821 46e774 100 API calls 22820->22821 22823 46e3fa 22821->22823 22824 46e3bf 22822->22824 22825 46e403 22823->22825 22826 46e410 22823->22826 22827 45aa04 98 API calls 22824->22827 22828 46e774 100 API calls 22825->22828 22829 46e774 100 API calls 22826->22829 22830 46e3c7 22827->22830 22835 46e3dc 22828->22835 22831 46e42b 22829->22831 22833 46e774 100 API calls 22830->22833 22832 46e2d4 98 API calls 22831->22832 22832->22835 22833->22835 22834 45a710 98 API calls 22836 46e461 22834->22836 22835->22834 22837 41063c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 22836->22837 22838 46e486 22837->22838 22839 4cba40 52 API calls 22838->22839 22841 46e4fe 22838->22841 22839->22841 22840 46e57c 22840->22811 22841->22840 22842 4cb0fc 64 API calls 22841->22842 22842->22841 22846 4101ec 22843->22846 22845 408356 22845->22697 22847 410222 22846->22847 22849 410253 22847->22849 22850 40fef8 MultiByteToWideChar 22847->22850 22849->22845 22850->22849 22852 5ce21c 22851->22852 22853 5ce1c6 22851->22853 22893 5c83b8 GetDC EnumFontsW ReleaseDC 22852->22893 22855 5c7f8c 3 API calls 22853->22855 22857 5ce1cd 22855->22857 22856 5ce224 22894 4ee5c4 113 API calls 22856->22894 22859 5ce1f1 22857->22859 22860 5ce1d1 22857->22860 22859->22852 22865 5c7f8c 3 API calls 22859->22865 22887 4ee5c4 113 API calls 22860->22887 22862 5ce22e 22895 5ce180 MulDiv 22862->22895 22863 5ce1da 22888 5ce180 MulDiv 22863->22888 22868 5ce1fc 22865->22868 22867 5ce236 22896 4ee504 112 API calls 22867->22896 22868->22852 22871 5ce200 22868->22871 22869 5ce1e2 22889 4ee504 112 API calls 22869->22889 22890 4ee5c4 113 API calls 22871->22890 22873 5ce1eb 22873->22659 22875 5ce209 22891 5ce180 MulDiv 22875->22891 22877 5ce211 22892 4ee504 112 API calls 22877->22892 22897 4ee238 22879->22897 22881 5ce29a SelectObject GetTextExtentPointW 22882 5ce2c8 22881->22882 22883 5ce2cb GetTextMetricsW ReleaseDC 22881->22883 22882->22883 22883->22661 22884->22664 22885->22666 22886->22668 22887->22863 22888->22869 22889->22873 22890->22875 22891->22877 22892->22873 22893->22856 22894->22862 22895->22867 22896->22873 22898 4ee271 EnterCriticalSection 22897->22898 22900 4ee47e 22897->22900 22899 4ee455 LeaveCriticalSection 22898->22899 22901 4ee2a0 22898->22901 22899->22881 22900->22881 22902 4ee38e 22901->22902 22903 4ee33c 22901->22903 22905 4101ec MultiByteToWideChar 22902->22905 22904 4101ec MultiByteToWideChar 22903->22904 22907 4ee361 22904->22907 22906 4ee3b4 22905->22906 22906->22881 22907->22881 22908->22679 22910 5118de 22909->22910 22910->22681 22911->22683 22912->22687 22914 40b278 22913->22914 22915 42402a SetCurrentDirectoryW 22914->22915 22915->22357 22916->22357 22920 60f09e 22917->22920 22918 5c745c GetSystemDirectoryW 22919 60f1e4 22918->22919 22953 60c038 22919->22953 22929 60f0ba 22920->22929 22969 5c77e8 38 API calls 22920->22969 22922 60f136 22924 60f171 22922->22924 22925 60f13a 22922->22925 22926 5c7430 GetWindowsDirectoryW 22924->22926 22928 5c745c GetSystemDirectoryW 22925->22928 22926->22929 22927 60f217 22930 60f221 GetLastError 22927->22930 22931 60f22a CloseHandle 22927->22931 22928->22929 22929->22918 22929->22919 22933 60f243 22930->22933 22960 60efd8 22931->22960 22933->22357 22934->22357 22935->22387 22936->22358 22937->22358 22938->22358 22939->22358 22940->22358 22941->22366 22942->22358 22943->22358 22944->22365 22945->22362 22946->22365 22947->22365 22948->22365 22949->22365 22950->22365 22951->22354 22952->22359 22954 60bf74 2 API calls 22953->22954 22955 60c051 22954->22955 22956 60c055 22955->22956 22957 60c05c CreateProcessW GetLastError 22955->22957 22956->22927 22958 60bfb0 Wow64RevertWow64FsRedirection 22957->22958 22959 60c0b1 22958->22959 22959->22927 22961 60f010 22960->22961 22962 60effc WaitForInputIdle 22960->22962 22963 60f032 GetExitCodeProcess 22961->22963 22967 60f017 MsgWaitForMultipleObjects 22961->22967 22962->22961 22965 60f040 22963->22965 22966 60f046 CloseHandle 22963->22966 22965->22966 22966->22933 22967->22961 22968 60f030 22967->22968 22968->22963 22969->22922 22970 68dff4 22971 68dfff 22970->22971 22976 62d05c 22971->22976 22975 68e01e 22987 62cfb8 22976->22987 22978 62d064 22979 5ada70 22978->22979 22980 5ada7b 22979->22980 22992 5b1bec 108 API calls 22980->22992 22982 5adad2 22993 5b52d4 103 API calls 22982->22993 22984 5adaf6 22994 5acc94 22984->22994 22986 5adb91 22986->22975 22988 62cfd5 GetVersion 22987->22988 22989 62d004 22987->22989 22988->22989 22990 62cfe2 22988->22990 22989->22978 22991 62cfea CoCreateInstance 22990->22991 22991->22989 22992->22982 22993->22984 22995 5acc9e 22994->22995 22998 5156a0 22995->22998 22997 5acce4 22997->22986 22999 5156ac 22998->22999 23013 476338 64 API calls 22999->23013 23001 5156b7 23014 51c224 104 API calls 23001->23014 23003 5156e2 23010 51573b 23003->23010 23015 516a28 23003->23015 23004 5156be 23004->23003 23019 50f840 98 API calls 23004->23019 23009 515786 23022 510fa8 104 API calls 23009->23022 23010->23009 23020 516ca4 98 API calls 23010->23020 23021 516a98 98 API calls 23010->23021 23012 51580a 23012->22997 23013->23001 23014->23004 23016 516a37 23015->23016 23017 516a44 23016->23017 23023 5b16a4 23016->23023 23017->23010 23019->23003 23020->23010 23021->23010 23022->23012 23024 5b16b1 23023->23024 23025 5b16e5 23024->23025 23027 5b15c8 23024->23027 23025->23017 23028 5b1657 23027->23028 23030 5b15ea 23027->23030 23028->23025 23029 5b163b 23029->23028 23037 5b1a08 100 API calls 23029->23037 23030->23029 23035 410300 64 API calls 23030->23035 23033 5b1627 23036 4098c4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 23033->23036 23035->23033 23037->23028

                                                                                          Executed Functions

                                                                                          Function 005C7CE0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 181memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 43%
                                                                                          			E005C7CE0(long __eax) {
				signed char _v5;
				void* _v12;
				char _v16;
				void* _v20;
				long _v24;
				void* _v28;
				struct _SID_IDENTIFIER_AUTHORITY* _v32;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t89;
				long _t97;
				signed int _t100;
				intOrPtr _t105;
				intOrPtr _t106;
				void* _t107;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t115;
				intOrPtr _t116;

				_t113 = _t115;
				_t116 = _t115 + 0xffffffe4;
				_push(_t107);
				_t97 = __eax;
				if(E00429D18() == 2) {
					_v5 = 0;
					_v32 = 0x6ccce0;
					if(AllocateAndInitializeSid(_v32, 2, 0x20, _t97, 0, 0, 0, 0, 0, 0,  &_v12) == 0) {
						goto L26;
					} else {
						_push(_t113);
						_push(0x5c7ecb);
						_push( *[fs:eax]);
						 *[fs:eax] = _t116;
						_t99 = 0;
						if((GetVersion() & 0x000000ff) >= 5) {
							_t99 = E00414020(0, _t107, GetModuleHandleW(L"advapi32.dll"), L"CheckTokenMembership");
						}
						if(_t99 == 0) {
							_v28 = 0;
							if(OpenThreadToken(GetCurrentThread(), 8, 0xffffffff,  &_v20) != 0) {
								L13:
								_push(_t113);
								_push(0x5c7ead);
								_push( *[fs:eax]);
								 *[fs:eax] = _t116;
								_v24 = 0;
								if(GetTokenInformation(_v20, 2, 0, 0,  &_v24) != 0 || GetLastError() == 0x7a) {
									_v28 = E00406F0C(_v24);
									if(GetTokenInformation(_v20, 2, _v28, _v24,  &_v24) != 0) {
										_t110 =  *_v28 - 1;
										if(_t110 >= 0) {
											_t111 = _t110 + 1;
											_t100 = 0;
											while(EqualSid(_v12,  *(_v28 + 4 + _t100 * 8)) == 0 || ( *(_v28 + 8 + _t100 * 8) & 0x00000014) != 4) {
												_t100 = _t100 + 1;
												_t111 = _t111 - 1;
												if(_t111 != 0) {
													continue;
												}
												goto L24;
											}
											_v5 = 1;
										}
										L24:
										_pop(_t105);
										 *[fs:eax] = _t105;
										_push(E005C7EB4);
										L00406F28(_v28);
										return CloseHandle(_v20);
									} else {
										E004099B8();
										E004099B8();
										goto L26;
									}
								} else {
									E004099B8();
									E004099B8();
									goto L26;
								}
							} else {
								if(GetLastError() == 0x3f0) {
									if(OpenProcessToken(GetCurrentProcess(), 8,  &_v20) != 0) {
										goto L13;
									} else {
										E004099B8();
										goto L26;
									}
								} else {
									E004099B8();
									goto L26;
								}
							}
						} else {
							_t89 =  *_t99(0, _v12,  &_v16); // executed
							if(_t89 != 0) {
								asm("sbb eax, eax");
								_v5 = _t89 + 1;
							}
							_pop(_t106);
							 *[fs:eax] = _t106;
							_push(E005C7ED2);
							return FreeSid(_v12);
						}
					}
				} else {
					_v5 = 1;
					L26:
					return _v5 & 0x000000ff;
				}
			}
























                                                                                          0x005c7ce1
                                                                                          0x005c7ce3
                                                                                          0x005c7ce7
                                                                                          0x005c7ce8
                                                                                          0x005c7cf2
                                                                                          0x005c7cfd
                                                                                          0x005c7d06
                                                                                          0x005c7d29
                                                                                          0x00000000
                                                                                          0x005c7d2f
                                                                                          0x005c7d31
                                                                                          0x005c7d32
                                                                                          0x005c7d37
                                                                                          0x005c7d3a
                                                                                          0x005c7d3d
                                                                                          0x005c7d4d
                                                                                          0x005c7d64
                                                                                          0x005c7d64
                                                                                          0x005c7d68
                                                                                          0x005c7d8f
                                                                                          0x005c7da7
                                                                                          0x005c7dde
                                                                                          0x005c7de0
                                                                                          0x005c7de1
                                                                                          0x005c7de6
                                                                                          0x005c7de9
                                                                                          0x005c7dee
                                                                                          0x005c7e06
                                                                                          0x005c7e29
                                                                                          0x005c7e45
                                                                                          0x005c7e58
                                                                                          0x005c7e5b
                                                                                          0x005c7e5d
                                                                                          0x005c7e5e
                                                                                          0x005c7e60
                                                                                          0x005c7e8a
                                                                                          0x005c7e8b
                                                                                          0x005c7e8c
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c7e8c
                                                                                          0x005c7e84
                                                                                          0x005c7e84
                                                                                          0x005c7e8e
                                                                                          0x005c7e90
                                                                                          0x005c7e93
                                                                                          0x005c7e96
                                                                                          0x005c7e9e
                                                                                          0x005c7eac
                                                                                          0x005c7e47
                                                                                          0x005c7e47
                                                                                          0x005c7e4c
                                                                                          0x00000000
                                                                                          0x005c7e4c
                                                                                          0x005c7e12
                                                                                          0x005c7e12
                                                                                          0x005c7e17
                                                                                          0x00000000
                                                                                          0x005c7e17
                                                                                          0x005c7da9
                                                                                          0x005c7db3
                                                                                          0x005c7dd2
                                                                                          0x00000000
                                                                                          0x005c7dd4
                                                                                          0x005c7dd4
                                                                                          0x00000000
                                                                                          0x005c7dd4
                                                                                          0x005c7db5
                                                                                          0x005c7db5
                                                                                          0x00000000
                                                                                          0x005c7db5
                                                                                          0x005c7db3
                                                                                          0x005c7d6a
                                                                                          0x005c7d74
                                                                                          0x005c7d78
                                                                                          0x005c7d82
                                                                                          0x005c7d85
                                                                                          0x005c7d85
                                                                                          0x005c7eb6
                                                                                          0x005c7eb9
                                                                                          0x005c7ebc
                                                                                          0x005c7eca
                                                                                          0x005c7eca
                                                                                          0x005c7d68
                                                                                          0x005c7cf4
                                                                                          0x005c7cf4
                                                                                          0x005c7ed2
                                                                                          0x005c7edb
                                                                                          0x005c7edb

                                                                                          APIs
                                                                                          • AllocateAndInitializeSid.ADVAPI32(00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C7D22
                                                                                          • GetVersion.KERNEL32(00000000,005C7ECB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C7D3F
                                                                                          • GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,005C7ECB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C7D59
                                                                                          • CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,005C7ECB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C7D74
                                                                                          • FreeSid.ADVAPI32(00000000,005C7ED2,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C7EC5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocateCheckFreeHandleInitializeMembershipModuleTokenVersion
                                                                                          • String ID: CheckTokenMembership$advapi32.dll
                                                                                          • API String ID: 2691416632-1888249752
                                                                                          • Opcode ID: a1322bb03b956706ebe217b7f77f5998dc262f29b8b5e1dfa85fdbc4603a3419
                                                                                          • Instruction ID: 9e47304f2c2519385998e5d426bc562542af73c677c294aaacd6cf1c30b33c32
                                                                                          • Opcode Fuzzy Hash: a1322bb03b956706ebe217b7f77f5998dc262f29b8b5e1dfa85fdbc4603a3419
                                                                                          • Instruction Fuzzy Hash: A2514472A0830D6EDB11EAF98D42FBE7BACBF1C705F1044AEF501E6681D6789D408B65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E7F0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 73%
                                                                                          			E0040E7F0(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E0040A2AC(_v8);
				_push(_t61);
				_push(0x40e8b0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L0040524C();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E0040B318( &_v20, 4,  &_v16);
				E0040B4C8(_t44, _v20, _v8);
				_t29 = E0040E6A0( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E0040B318( &_v24, 4,  &_v16);
					E0040B4C8(_t44, _v24, _v8);
					_t40 = E0040E6A0( *_t44, _t44); // executed
					if(_t40 == 0) {
						E0040A1C8(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E0040E8B7);
				E0040A228( &_v24, 2);
				return E0040A1C8( &_v8);
			}













                                                                                          0x0040e7f6
                                                                                          0x0040e7f9
                                                                                          0x0040e7fc
                                                                                          0x0040e7ff
                                                                                          0x0040e801
                                                                                          0x0040e807
                                                                                          0x0040e80e
                                                                                          0x0040e80f
                                                                                          0x0040e814
                                                                                          0x0040e817
                                                                                          0x0040e81c
                                                                                          0x0040e822
                                                                                          0x0040e82b
                                                                                          0x0040e83b
                                                                                          0x0040e848
                                                                                          0x0040e84f
                                                                                          0x0040e856
                                                                                          0x0040e858
                                                                                          0x0040e869
                                                                                          0x0040e876
                                                                                          0x0040e87d
                                                                                          0x0040e884
                                                                                          0x0040e888
                                                                                          0x0040e888
                                                                                          0x0040e884
                                                                                          0x0040e88f
                                                                                          0x0040e892
                                                                                          0x0040e895
                                                                                          0x0040e8a2
                                                                                          0x0040e8af

                                                                                          APIs
                                                                                          • GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040E8B0,?,?), ref: 0040E822
                                                                                          • GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040E8B0,?,?), ref: 0040E82B
                                                                                            • Part of subcall function 0040E6A0: FindFirstFileW.KERNEL32(00000000,?,00000000,0040E6FE,?,?), ref: 0040E6D3
                                                                                            • Part of subcall function 0040E6A0: FindClose.KERNEL32(00000000,00000000,?,00000000,0040E6FE,?,?), ref: 0040E6E3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
                                                                                          • String ID:
                                                                                          • API String ID: 3216391948-0
                                                                                          • Opcode ID: aeb535607b5f99499f2a767ddc83956c015e9bc377906081bbf7d3440128e813
                                                                                          • Instruction ID: 1e50cd0e94847efb8cb05e6df71b151ee34378a03d53e12baea26e8823c5d93b
                                                                                          • Opcode Fuzzy Hash: aeb535607b5f99499f2a767ddc83956c015e9bc377906081bbf7d3440128e813
                                                                                          • Instruction Fuzzy Hash: 71114270A002099BDB04EF96D982AAEB3B9EF45304F90487EF904B73C1D7395E148B6D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0062CFB8 Relevance: 3.1, APIs: 2, Instructions: 52comCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 48%
                                                                                          			E0062CFB8(void* __ebx) {
				void* _v8;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr* _t22;
				intOrPtr* _t25;
				intOrPtr _t34;
				intOrPtr _t38;

				_push(0);
				_push(_t38);
				_push(0x62d04e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t38;
				if( *0x6d63b4 != 0) {
					L6:
					_pop(_t34);
					 *[fs:eax] = _t34;
					_push(E0062D055);
					return E0040EC28( &_v8);
				}
				if(GetVersion() >= 0x601) {
					_push(E0040EC28( &_v8));
					_t20 =  *0x6ce1cc; // 0x6cd0d4
					_push(_t20);
					_push(1);
					_push(0);
					_t21 =  *0x6cdad4; // 0x6cd0c4
					_push(_t21); // executed
					L0043C1EC(); // executed
					if(_t21 == 0) {
						_t22 = _v8;
						_push(_t22);
						if( *((intOrPtr*)( *_t22 + 0xc))() == 0) {
							_t25 = _v8;
							 *((intOrPtr*)( *_t25 + 4))(_t25);
							E0040EC40(0x6d63b8, _v8);
						}
					}
				}
				 *0x6d63b4 = 1;
				goto L6;
			}










                                                                                          0x0062cfbb
                                                                                          0x0062cfc0
                                                                                          0x0062cfc1
                                                                                          0x0062cfc6
                                                                                          0x0062cfc9
                                                                                          0x0062cfd3
                                                                                          0x0062d02e
                                                                                          0x0062d03a
                                                                                          0x0062d03d
                                                                                          0x0062d040
                                                                                          0x0062d04d
                                                                                          0x0062d04d
                                                                                          0x0062cfe0
                                                                                          0x0062cfea
                                                                                          0x0062cfeb
                                                                                          0x0062cff0
                                                                                          0x0062cff1
                                                                                          0x0062cff3
                                                                                          0x0062cff5
                                                                                          0x0062cffa
                                                                                          0x0062cffb
                                                                                          0x0062d002
                                                                                          0x0062d004
                                                                                          0x0062d007
                                                                                          0x0062d00f
                                                                                          0x0062d011
                                                                                          0x0062d017
                                                                                          0x0062d022
                                                                                          0x0062d022
                                                                                          0x0062d00f
                                                                                          0x0062d002
                                                                                          0x0062d027
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(00000000,0062D04E,?,00000000,00000000,?,0062D064,?,0068E013), ref: 0062CFD5
                                                                                          • CoCreateInstance.OLE32(006CD0C4,00000000,00000001,006CD0D4,00000000,00000000,0062D04E,?,00000000,00000000,?,0062D064,?,0068E013), ref: 0062CFFB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateInstanceVersion
                                                                                          • String ID:
                                                                                          • API String ID: 1462612201-0
                                                                                          • Opcode ID: 03b4c5e3fd0bb2660353040baee757c4ce55d2c400f110da36a34914547bf74e
                                                                                          • Instruction ID: 9475dfad4fa877b1df6a840545b6a6068a8d92e7f1f871649489f85859f50de3
                                                                                          • Opcode Fuzzy Hash: 03b4c5e3fd0bb2660353040baee757c4ce55d2c400f110da36a34914547bf74e
                                                                                          • Instruction Fuzzy Hash: F511D231648A04AFEB10EF69ED4AF5A77EEEB45308F4214BAF400D7AA1C775AD10CB15
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060C2B0 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 60%
                                                                                          			E0060C2B0(void* __eax, struct _WIN32_FIND_DATAW* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				char _v16;
				long _v20;
				void* _t13;
				intOrPtr _t27;
				void* _t35;
				void* _t37;
				intOrPtr _t38;

				_t35 = _t37;
				_t38 = _t37 + 0xfffffff0;
				if(E0060BF74(__eax,  &_v16) != 0) {
					_push(_t35);
					_push(0x60c313);
					_push( *[fs:eax]);
					 *[fs:eax] = _t38;
					_t13 = FindFirstFileW(E0040B278(__edx), __ecx); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E0060C31A);
					return E0060BFB0( &_v16);
				} else {
					_v8 = 0xffffffff;
					return _v8;
				}
			}











                                                                                          0x0060c2b1
                                                                                          0x0060c2b3
                                                                                          0x0060c2cb
                                                                                          0x0060c2d8
                                                                                          0x0060c2d9
                                                                                          0x0060c2de
                                                                                          0x0060c2e1
                                                                                          0x0060c2ed
                                                                                          0x0060c2f2
                                                                                          0x0060c2fa
                                                                                          0x0060c2ff
                                                                                          0x0060c302
                                                                                          0x0060c305
                                                                                          0x0060c312
                                                                                          0x0060c2cd
                                                                                          0x0060c2cd
                                                                                          0x0060c32c
                                                                                          0x0060c32c

                                                                                          APIs
                                                                                          • FindFirstFileW.KERNEL32(00000000,?,00000000,0060C313,?,?,?,00000000), ref: 0060C2ED
                                                                                          • GetLastError.KERNEL32(00000000,?,00000000,0060C313,?,?,?,00000000), ref: 0060C2F5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileFindFirstLast
                                                                                          • String ID:
                                                                                          • API String ID: 873889042-0
                                                                                          • Opcode ID: 9b815883e24a1e0269e7ab11e85652bd67a5c92831970d367b7e3078257b8878
                                                                                          • Instruction ID: 0e0656a6fbe86c5836fc78b0efda7e26b232c5910eabf30e6ebd6b813bae866c
                                                                                          • Opcode Fuzzy Hash: 9b815883e24a1e0269e7ab11e85652bd67a5c92831970d367b7e3078257b8878
                                                                                          • Instruction Fuzzy Hash: 1BF0F931A84208ABCB14DFBA9C0189FF7ADEB4533075147BAF814D32D1DB744E004598
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E6A0 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 46%
                                                                                          			E0040E6A0(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E0040A2AC(_v8);
				_push(_t27);
				_push(0x40e6fe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E0040B278(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E0040E705);
				return E0040A1C8( &_v8);
			}








                                                                                          0x0040e6a9
                                                                                          0x0040e6aa
                                                                                          0x0040e6b0
                                                                                          0x0040e6b7
                                                                                          0x0040e6b8
                                                                                          0x0040e6bd
                                                                                          0x0040e6c0
                                                                                          0x0040e6d3
                                                                                          0x0040e6e0
                                                                                          0x0040e6e3
                                                                                          0x0040e6e3
                                                                                          0x0040e6ea
                                                                                          0x0040e6ed
                                                                                          0x0040e6f0
                                                                                          0x0040e6fd

                                                                                          APIs
                                                                                          • FindFirstFileW.KERNEL32(00000000,?,00000000,0040E6FE,?,?), ref: 0040E6D3
                                                                                          • FindClose.KERNEL32(00000000,00000000,?,00000000,0040E6FE,?,?), ref: 0040E6E3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseFileFirst
                                                                                          • String ID:
                                                                                          • API String ID: 2295610775-0
                                                                                          • Opcode ID: 3eb78bd68c4b55486ee142453826f5702aca1725e87d240b550eb8c2cf35fd69
                                                                                          • Instruction ID: dec86fcb97929b74413189edb203bd87f329489ef31ab21fd3caa719f1a03e71
                                                                                          • Opcode Fuzzy Hash: 3eb78bd68c4b55486ee142453826f5702aca1725e87d240b550eb8c2cf35fd69
                                                                                          • Instruction Fuzzy Hash: 95F0B430540608AFCB10EBB6DC4295EB3ACEB4431479009B6F400F32D1EB395E10995C
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E2C4 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173registryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 78%
                                                                                          			E0040E2C4(char __eax, void* __ebx, void* __ecx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t106;
				intOrPtr _t108;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E0040A2AC(_v8);
				_push(_t112);
				_push(0x40e4e9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				if(_v8 != 0) {
					E0040DAF8( &_v542, E0040B278(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(E0040E4F0);
					return E0040A1C8( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t112);
						_push(0x40e4cc);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						E0040E0D4( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E0040E5DC, 0, 0, 0,  &_v20) == 0) {
								_v12 = E00406F0C(_v20);
								RegQueryValueExW(_v16, E0040E5DC, 0, 0, _v12,  &_v20);
								E0040B2DC(_t97, _v12);
							}
						} else {
							_v12 = E00406F0C(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E0040B2DC(_t97, _v12);
						}
						_pop(_t108);
						 *[fs:eax] = _t108;
						_push(E0040E4D3);
						if(_v12 != 0) {
							L00406F28(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}




















                                                                                          0x0040e2c5
                                                                                          0x0040e2c7
                                                                                          0x0040e2ce
                                                                                          0x0040e2d0
                                                                                          0x0040e2d6
                                                                                          0x0040e2dd
                                                                                          0x0040e2de
                                                                                          0x0040e2e3
                                                                                          0x0040e2e6
                                                                                          0x0040e2ed
                                                                                          0x0040e319
                                                                                          0x0040e2ef
                                                                                          0x0040e2fd
                                                                                          0x0040e2fd
                                                                                          0x0040e326
                                                                                          0x0040e4d3
                                                                                          0x0040e4d5
                                                                                          0x0040e4d8
                                                                                          0x0040e4db
                                                                                          0x0040e4e8
                                                                                          0x0040e32c
                                                                                          0x0040e32e
                                                                                          0x0040e346
                                                                                          0x0040e34d
                                                                                          0x0040e3ed
                                                                                          0x0040e3ef
                                                                                          0x0040e3f0
                                                                                          0x0040e3f5
                                                                                          0x0040e3f8
                                                                                          0x0040e406
                                                                                          0x0040e427
                                                                                          0x0040e476
                                                                                          0x0040e480
                                                                                          0x0040e498
                                                                                          0x0040e4a2
                                                                                          0x0040e4a2
                                                                                          0x0040e429
                                                                                          0x0040e431
                                                                                          0x0040e44b
                                                                                          0x0040e455
                                                                                          0x0040e455
                                                                                          0x0040e4a9
                                                                                          0x0040e4ac
                                                                                          0x0040e4af
                                                                                          0x0040e4b8
                                                                                          0x0040e4bd
                                                                                          0x0040e4bd
                                                                                          0x0040e4cb
                                                                                          0x0040e353
                                                                                          0x0040e368
                                                                                          0x0040e36f
                                                                                          0x00000000
                                                                                          0x0040e371
                                                                                          0x0040e386
                                                                                          0x0040e38d
                                                                                          0x00000000
                                                                                          0x0040e38f
                                                                                          0x0040e3a4
                                                                                          0x0040e3ab
                                                                                          0x00000000
                                                                                          0x0040e3ad
                                                                                          0x0040e3c2
                                                                                          0x0040e3c9
                                                                                          0x00000000
                                                                                          0x0040e3cb
                                                                                          0x0040e3e0
                                                                                          0x0040e3e7
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040e3e7
                                                                                          0x0040e3c9
                                                                                          0x0040e3ab
                                                                                          0x0040e38d
                                                                                          0x0040e36f
                                                                                          0x0040e34d

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4E9,?,?), ref: 0040E2FD
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9,?,?), ref: 0040E346
                                                                                          • RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9,?,?), ref: 0040E368
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040E386
                                                                                          • RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040E3A4
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040E3C2
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040E3E0
                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9), ref: 0040E420
                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001), ref: 0040E44B
                                                                                          • RegCloseKey.ADVAPI32(?,0040E4D3,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001,Software\Embarcadero\Locales), ref: 0040E4C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open$QueryValue$CloseFileModuleName
                                                                                          • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
                                                                                          • API String ID: 2701450724-3496071916
                                                                                          • Opcode ID: 7fd5c77da5b5d186a20b5e9baf64928ad92e7a189cbc4267def247f929261341
                                                                                          • Instruction ID: 4455e1c2a3f30db0af6e145a4bce986524b579b5894be5bc8a3c80d05520e853
                                                                                          • Opcode Fuzzy Hash: 7fd5c77da5b5d186a20b5e9baf64928ad92e7a189cbc4267def247f929261341
                                                                                          • Instruction Fuzzy Hash: 5C51F775A40608BEEB10DAA6CC42FAF77BCDB08704F5044BBBA14F61C2D6789A50DB5D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC23C Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 223COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 84 6ac23c-6ac23f 85 6ac244-6ac249 84->85 85->85 86 6ac24b-6ac2bc call 5c7430 call 40a5a8 call 5c745c call 40a5a8 call 5c7488 call 40a5a8 call 5c7530 call 40a5a8 call 429d18 85->86 105 6ac2da-6ac2df call 40a1c8 86->105 106 6ac2be-6ac2d8 call 5c6d5c call 40a5a8 86->106 110 6ac2e4-6ac2eb 105->110 106->110 111 6ac31f-6ac342 call 6ac0d0 call 40a5a8 110->111 112 6ac2ed-6ac30e call 5c53a0 call 40a5a8 110->112 124 6ac359-6ac37c call 6ac0d0 call 40a5a8 111->124 125 6ac344-6ac354 call 40b4c8 111->125 112->111 123 6ac310-6ac31a call 40a5a8 112->123 123->111 132 6ac37e-6ac398 call 5c4ea4 call 40b4c8 124->132 133 6ac39d-6ac3a4 124->133 125->124 132->133 135 6ac3a6-6ac3c9 call 6ac0d0 call 40a5a8 133->135 136 6ac404-6ac40b 133->136 161 6ac3cb-6ac3d0 call 60cd28 135->161 162 6ac3d5-6ac3df call 6ac0d0 135->162 138 6ac51d-6ac524 136->138 139 6ac411-6ac41e 136->139 141 6ac526-6ac545 call 5c4ea4 call 40b4c8 138->141 142 6ac547-6ac561 call 5c4ea4 call 40b4c8 138->142 139->138 144 6ac424-6ac43c SHGetKnownFolderPath 139->144 167 6ac566 call 6ac180 141->167 142->167 147 6ac43e-6ac46f call 40c8bc CoTaskMemFree 144->147 148 6ac477-6ac48f SHGetKnownFolderPath 144->148 155 6ac4ca-6ac4e2 SHGetKnownFolderPath 148->155 156 6ac491-6ac4c2 call 40c8bc CoTaskMemFree 148->156 155->138 157 6ac4e4-6ac515 call 40c8bc CoTaskMemFree 155->157 161->162 170 6ac3e4-6ac3f8 call 40a5a8 162->170 173 6ac56b-6ac585 call 40a228 167->173 170->136 178 6ac3fa-6ac3ff call 60cd28 170->178 178->136
                                                                                          C-Code - Quality: 65%
                                                                                          			E006AC23C(void* __ebx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				char _v60;
				void* _t54;
				intOrPtr _t65;
				intOrPtr _t73;
				unsigned int _t77;
				void* _t80;
				char _t82;
				char _t84;
				intOrPtr _t89;
				intOrPtr _t94;
				intOrPtr _t99;
				intOrPtr _t112;
				intOrPtr _t118;
				void* _t129;
				intOrPtr _t158;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t167;
				intOrPtr _t174;
				intOrPtr _t182;
				intOrPtr _t183;

				_t128 = __ebx;
				_t182 = _t183;
				_t129 = 7;
				do {
					_push(0);
					_push(0);
					_t129 = _t129 - 1;
					_t184 = _t129;
				} while (_t129 != 0);
				_push(_t182);
				_push(0x6ac586);
				_push( *[fs:eax]);
				 *[fs:eax] = _t183;
				E005C7430( &_v12);
				E0040A5A8(0x6d6534, _v12);
				E005C745C( &_v16);
				E0040A5A8(0x6d6538, _v16);
				E005C7488( &_v20, __esi, _t182, _t184);
				E0040A5A8(0x6d653c, _v20);
				E005C7530( *0x6d67dd & 0x000000ff, __ebx,  &_v24, __esi);
				E0040A5A8(0x6d6540, _v24);
				_t54 = E00429D18();
				_t185 = _t54 - 2;
				if(_t54 != 2) {
					E0040A1C8(0x6d6544);
				} else {
					E005C6D5C(L"SystemDrive", _t129,  &_v28, _t185);
					E0040A5A8(0x6d6544, _v28);
				}
				if( *0x6d6544 == 0) {
					_t118 =  *0x6d6534; // 0x24f8bf4
					E005C53A0(_t118,  &_v32);
					E0040A5A8(0x6d6544, _v32);
					_t187 =  *0x6d6544;
					if( *0x6d6544 == 0) {
						E0040A5A8(0x6d6544, 0x6ac5c4);
					}
				}
				E006AC0D0(1, L"ProgramFilesDir", _t187); // executed
				E0040A5A8(0x6d6548, _v36);
				_t188 =  *0x6d6548;
				if( *0x6d6548 == 0) {
					_t174 =  *0x6d6544; // 0x24e3f54
					E0040B4C8(0x6d6548, L"\\Program Files", _t174);
				}
				E006AC0D0(1, L"CommonFilesDir", _t188); // executed
				E0040A5A8(0x6d654c, _v40);
				if( *0x6d654c == 0) {
					_t112 =  *0x6d6548; // 0x2524f1c
					E005C4EA4(_t112,  &_v44);
					E0040B4C8(0x6d654c, L"Common Files", _v44);
				}
				_t190 =  *0x6d67dd;
				if( *0x6d67dd != 0) {
					E006AC0D0(2, L"ProgramFilesDir", _t190); // executed
					E0040A5A8(0x6d6550, _v48);
					_t191 =  *0x6d6550;
					if( *0x6d6550 == 0) {
						E0060CD28(L"Failed to get path of 64-bit Program Files directory", _t128);
					}
					E006AC0D0(2, L"CommonFilesDir", _t191); // executed
					E0040A5A8(0x6d6554, _v52);
					if( *0x6d6554 == 0) {
						E0060CD28(L"Failed to get path of 64-bit Common Files directory", _t128);
					}
				}
				if( *0x6d68ac == 0) {
					L25:
					__eflags =  *0x6d67dc;
					if( *0x6d67dc == 0) {
						_t65 =  *0x6d6534; // 0x24f8bf4
						E005C4EA4(_t65,  &_v60);
						E0040B4C8(0x6d6564, L"COMMAND.COM", _v60); // executed
					} else {
						_t73 =  *0x6d6538; // 0x2515afc
						E005C4EA4(_t73,  &_v56);
						E0040B4C8(0x6d6564, L"cmd.exe", _v56);
					}
					E006AC180(); // executed
					__eflags = 0;
					_pop(_t158);
					 *[fs:eax] = _t158;
					_push(E006AC58D);
					return E0040A228( &_v60, 0xd);
				} else {
					_t77 =  *0x6d67f0; // 0xa0042ee
					if(_t77 >> 0x10 < 0x600) {
						goto L25;
					} else {
						_t80 =  *0x6d68ac(0x6cd7f4, 0x8000, 0,  &_v8); // executed
						if(_t80 != 0) {
							_t82 =  *0x6d68ac(0x6cd804, 0x8000, 0,  &_v8); // executed
							__eflags = _t82;
							if(_t82 != 0) {
								_t84 =  *0x6d68ac(0x6cd814, 0x8000, 0,  &_v8); // executed
								__eflags = _t84;
								if(_t84 != 0) {
									goto L25;
								} else {
									_push(_t182);
									_push(0x6ac516);
									_push( *[fs:eax]);
									 *[fs:eax] = _t183;
									E0040C8BC();
									__eflags = 0;
									_pop(_t163);
									 *[fs:eax] = _t163;
									_push(E006AC51D);
									_t89 = _v8;
									_push(_t89);
									L0043C214();
									return _t89;
								}
							} else {
								_push(_t182);
								_push(0x6ac4c3);
								_push( *[fs:eax]);
								 *[fs:eax] = _t183;
								E0040C8BC();
								__eflags = 0;
								_pop(_t165);
								 *[fs:eax] = _t165;
								_push(E006AC4CA);
								_t94 = _v8;
								_push(_t94);
								L0043C214();
								return _t94;
							}
						} else {
							_push(_t182);
							_push(0x6ac470);
							_push( *[fs:eax]);
							 *[fs:eax] = _t183;
							E0040C8BC();
							_pop(_t167);
							 *[fs:eax] = _t167;
							_push(E006AC477);
							_t99 = _v8;
							_push(_t99);
							L0043C214();
							return _t99;
						}
					}
				}
			}





































                                                                                          0x006ac23c
                                                                                          0x006ac23d
                                                                                          0x006ac23f
                                                                                          0x006ac244
                                                                                          0x006ac244
                                                                                          0x006ac246
                                                                                          0x006ac248
                                                                                          0x006ac248
                                                                                          0x006ac248
                                                                                          0x006ac24d
                                                                                          0x006ac24e
                                                                                          0x006ac253
                                                                                          0x006ac256
                                                                                          0x006ac25c
                                                                                          0x006ac269
                                                                                          0x006ac271
                                                                                          0x006ac27e
                                                                                          0x006ac286
                                                                                          0x006ac293
                                                                                          0x006ac2a2
                                                                                          0x006ac2af
                                                                                          0x006ac2b4
                                                                                          0x006ac2b9
                                                                                          0x006ac2bc
                                                                                          0x006ac2df
                                                                                          0x006ac2be
                                                                                          0x006ac2c6
                                                                                          0x006ac2d3
                                                                                          0x006ac2d3
                                                                                          0x006ac2eb
                                                                                          0x006ac2f0
                                                                                          0x006ac2f5
                                                                                          0x006ac302
                                                                                          0x006ac307
                                                                                          0x006ac30e
                                                                                          0x006ac31a
                                                                                          0x006ac31a
                                                                                          0x006ac30e
                                                                                          0x006ac329
                                                                                          0x006ac336
                                                                                          0x006ac33b
                                                                                          0x006ac342
                                                                                          0x006ac34e
                                                                                          0x006ac354
                                                                                          0x006ac354
                                                                                          0x006ac363
                                                                                          0x006ac370
                                                                                          0x006ac37c
                                                                                          0x006ac381
                                                                                          0x006ac386
                                                                                          0x006ac398
                                                                                          0x006ac398
                                                                                          0x006ac39d
                                                                                          0x006ac3a4
                                                                                          0x006ac3b0
                                                                                          0x006ac3bd
                                                                                          0x006ac3c2
                                                                                          0x006ac3c9
                                                                                          0x006ac3d0
                                                                                          0x006ac3d0
                                                                                          0x006ac3df
                                                                                          0x006ac3ec
                                                                                          0x006ac3f8
                                                                                          0x006ac3ff
                                                                                          0x006ac3ff
                                                                                          0x006ac3f8
                                                                                          0x006ac40b
                                                                                          0x006ac51d
                                                                                          0x006ac51d
                                                                                          0x006ac524
                                                                                          0x006ac54a
                                                                                          0x006ac54f
                                                                                          0x006ac561
                                                                                          0x006ac526
                                                                                          0x006ac529
                                                                                          0x006ac52e
                                                                                          0x006ac540
                                                                                          0x006ac540
                                                                                          0x006ac566
                                                                                          0x006ac56b
                                                                                          0x006ac56d
                                                                                          0x006ac570
                                                                                          0x006ac573
                                                                                          0x006ac585
                                                                                          0x006ac411
                                                                                          0x006ac411
                                                                                          0x006ac41e
                                                                                          0x00000000
                                                                                          0x006ac424
                                                                                          0x006ac434
                                                                                          0x006ac43c
                                                                                          0x006ac487
                                                                                          0x006ac48d
                                                                                          0x006ac48f
                                                                                          0x006ac4da
                                                                                          0x006ac4e0
                                                                                          0x006ac4e2
                                                                                          0x00000000
                                                                                          0x006ac4e4
                                                                                          0x006ac4e6
                                                                                          0x006ac4e7
                                                                                          0x006ac4ec
                                                                                          0x006ac4ef
                                                                                          0x006ac4fa
                                                                                          0x006ac4ff
                                                                                          0x006ac501
                                                                                          0x006ac504
                                                                                          0x006ac507
                                                                                          0x006ac50c
                                                                                          0x006ac50f
                                                                                          0x006ac510
                                                                                          0x006ac515
                                                                                          0x006ac515
                                                                                          0x006ac491
                                                                                          0x006ac493
                                                                                          0x006ac494
                                                                                          0x006ac499
                                                                                          0x006ac49c
                                                                                          0x006ac4a7
                                                                                          0x006ac4ac
                                                                                          0x006ac4ae
                                                                                          0x006ac4b1
                                                                                          0x006ac4b4
                                                                                          0x006ac4b9
                                                                                          0x006ac4bc
                                                                                          0x006ac4bd
                                                                                          0x006ac4c2
                                                                                          0x006ac4c2
                                                                                          0x006ac43e
                                                                                          0x006ac440
                                                                                          0x006ac441
                                                                                          0x006ac446
                                                                                          0x006ac449
                                                                                          0x006ac454
                                                                                          0x006ac45b
                                                                                          0x006ac45e
                                                                                          0x006ac461
                                                                                          0x006ac466
                                                                                          0x006ac469
                                                                                          0x006ac46a
                                                                                          0x006ac46f
                                                                                          0x006ac46f
                                                                                          0x006ac43c
                                                                                          0x006ac41e

                                                                                          APIs
                                                                                          • SHGetKnownFolderPath.SHELL32(006CD7F4,00008000,00000000,?,00000000,006AC586,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A), ref: 006AC434
                                                                                          • CoTaskMemFree.OLE32(?,006AC477,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC46A
                                                                                          • SHGetKnownFolderPath.SHELL32(006CD804,00008000,00000000,?,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC487
                                                                                          • CoTaskMemFree.OLE32(?,006AC4CA,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC4BD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FolderFreeKnownPathTask
                                                                                          • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                          • API String ID: 969438705-544719455
                                                                                          • Opcode ID: 37b86f27884b5b490c97ff6edc429fdbf2f367bc38347cd1232649234ca6d99b
                                                                                          • Instruction ID: b9958020655176fa4da1f40778f72373ecd7cbade583b9d7093994fb637c8e1d
                                                                                          • Opcode Fuzzy Hash: 37b86f27884b5b490c97ff6edc429fdbf2f367bc38347cd1232649234ca6d99b
                                                                                          • Instruction Fuzzy Hash: A281D530E012049FDB10FFA4E852BAD7BA7EB8A714F50447AF400A7395C678AD51CF65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060F06C Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 157COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 53%
                                                                                          			E0060F06C(signed char __eax, void* __ebx, char __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4, void* _a8, signed short _a12, signed char _a16, char _a20) {
				char _v8;
				signed char _v9;
				short _v32;
				intOrPtr _v36;
				char _v80;
				void* _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t75;
				intOrPtr _t107;
				char _t114;
				intOrPtr _t132;
				void* _t142;
				intOrPtr* _t144;
				void* _t147;

				_t116 = __ecx;
				_v116 = 0;
				_v120 = 0;
				_v108 = 0;
				_v112 = 0;
				_v104 = 0;
				_v100 = 0;
				_v8 = 0;
				_t114 = __ecx;
				_t142 = __edx;
				_v9 = __eax;
				_t144 = _a4;
				E0040A2AC(_a20);
				_push(_t147);
				_push(0x60f26e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t147 + 0xffffff8c;
				E0040B660(_t142, 0x60f28c);
				if(0 != 0) {
					_push(0x60f29c);
					_push(_t142);
					_push(0x60f29c);
					E0040B550( &_v8, _t114, 3, _t142, _t144);
					__eflags = _t114;
					if(_t114 != 0) {
						_push(_v8);
						_push(0x60f2ac);
						_push(_t114);
						E0040B550( &_v8, _t114, 3, _t142, _t144);
					}
					E005C53D0(_t142,  &_v100);
					_t63 = E00422368(_v100, _t116, L".bat");
					__eflags = _t63;
					if(_t63 == 0) {
						L6:
						_t64 = E005C77E8();
						__eflags = _t64;
						if(_t64 == 0) {
							_push(0x60f29c);
							E005C7430( &_v120);
							E005C4EA4(_v120,  &_v116);
							_push(_v116);
							_push(L"COMMAND.COM\" /C ");
							_push(_v8);
							E0040B550( &_v8, _t114, 4, _t142, _t144);
						} else {
							_push(0x60f29c);
							E005C745C( &_v112);
							E005C4EA4(_v112,  &_v108);
							_push(_v108);
							_push(L"cmd.exe\" /C \"");
							_push(_v8);
							_push(0x60f29c);
							E0040B550( &_v8, _t114, 5, _t142, _t144);
						}
						goto L9;
					} else {
						E005C53D0(_t142,  &_v104);
						_t107 = E00422368(_v104, _t116, L".cmd");
						__eflags = _t107;
						if(_t107 != 0) {
							L9:
							__eflags = _a20;
							if(_a20 == 0) {
								E005C5378(_t142, _t116,  &_a20);
							}
							goto L11;
						}
						goto L6;
					}
				} else {
					E0040A5F0( &_v8, _t114);
					L11:
					E00407760( &_v80, 0x44);
					_v80 = 0x44;
					_v36 = 1;
					_v32 = _a12 & 0x0000ffff;
					_t150 = _a20;
					if(_a20 == 0) {
						E005C745C( &_a20);
					}
					_t75 = E0040B278(_a20);
					E0060C038(_v9 & 0x000000ff, E0040B278(_v8), 0, _t150,  &_v96,  &_v80, _t75, 0, 0x4000000, 0, 0, 0); // executed
					asm("sbb ebx, ebx");
					_t115 = _t114 + 1;
					if(_t114 + 1 != 0) {
						CloseHandle(_v92);
						E0060EFD8(_v96, _t115, _a16 & 0x000000ff, _t142, _t144, _t144); // executed
					} else {
						 *_t144 = GetLastError();
					}
					_pop(_t132);
					 *[fs:eax] = _t132;
					_push(E0060F275);
					E0040A228( &_v120, 6);
					E0040A1C8( &_v8);
					return E0040A1C8( &_a20);
				}
			}

























                                                                                          0x0060f06c
                                                                                          0x0060f077
                                                                                          0x0060f07a
                                                                                          0x0060f07d
                                                                                          0x0060f080
                                                                                          0x0060f083
                                                                                          0x0060f086
                                                                                          0x0060f089
                                                                                          0x0060f08c
                                                                                          0x0060f08e
                                                                                          0x0060f090
                                                                                          0x0060f093
                                                                                          0x0060f099
                                                                                          0x0060f0a0
                                                                                          0x0060f0a1
                                                                                          0x0060f0a6
                                                                                          0x0060f0a9
                                                                                          0x0060f0b3
                                                                                          0x0060f0b8
                                                                                          0x0060f0c9
                                                                                          0x0060f0ce
                                                                                          0x0060f0cf
                                                                                          0x0060f0dc
                                                                                          0x0060f0e1
                                                                                          0x0060f0e3
                                                                                          0x0060f0e5
                                                                                          0x0060f0e8
                                                                                          0x0060f0ed
                                                                                          0x0060f0f6
                                                                                          0x0060f0f6
                                                                                          0x0060f100
                                                                                          0x0060f10d
                                                                                          0x0060f112
                                                                                          0x0060f114
                                                                                          0x0060f131
                                                                                          0x0060f131
                                                                                          0x0060f136
                                                                                          0x0060f138
                                                                                          0x0060f171
                                                                                          0x0060f179
                                                                                          0x0060f184
                                                                                          0x0060f189
                                                                                          0x0060f18c
                                                                                          0x0060f191
                                                                                          0x0060f19c
                                                                                          0x0060f13a
                                                                                          0x0060f13a
                                                                                          0x0060f142
                                                                                          0x0060f14d
                                                                                          0x0060f152
                                                                                          0x0060f155
                                                                                          0x0060f15a
                                                                                          0x0060f15d
                                                                                          0x0060f16a
                                                                                          0x0060f16a
                                                                                          0x00000000
                                                                                          0x0060f116
                                                                                          0x0060f11b
                                                                                          0x0060f128
                                                                                          0x0060f12d
                                                                                          0x0060f12f
                                                                                          0x0060f1a1
                                                                                          0x0060f1a1
                                                                                          0x0060f1a5
                                                                                          0x0060f1ac
                                                                                          0x0060f1ac
                                                                                          0x00000000
                                                                                          0x0060f1a5
                                                                                          0x00000000
                                                                                          0x0060f12f
                                                                                          0x0060f0ba
                                                                                          0x0060f0bf
                                                                                          0x0060f1b1
                                                                                          0x0060f1bb
                                                                                          0x0060f1c0
                                                                                          0x0060f1c7
                                                                                          0x0060f1d2
                                                                                          0x0060f1d6
                                                                                          0x0060f1da
                                                                                          0x0060f1df
                                                                                          0x0060f1df
                                                                                          0x0060f1f4
                                                                                          0x0060f212
                                                                                          0x0060f21a
                                                                                          0x0060f21c
                                                                                          0x0060f21f
                                                                                          0x0060f22e
                                                                                          0x0060f23e
                                                                                          0x0060f221
                                                                                          0x0060f226
                                                                                          0x0060f226
                                                                                          0x0060f245
                                                                                          0x0060f248
                                                                                          0x0060f24b
                                                                                          0x0060f258
                                                                                          0x0060f260
                                                                                          0x0060f26d
                                                                                          0x0060f26d

                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0060F29C,0060F29C,?,0060F29C,00000000), ref: 0060F221
                                                                                          • CloseHandle.KERNEL32(006B7E1B,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0060F29C,0060F29C,?,0060F29C), ref: 0060F22E
                                                                                            • Part of subcall function 0060EFD8: WaitForInputIdle.USER32 ref: 0060F004
                                                                                            • Part of subcall function 0060EFD8: MsgWaitForMultipleObjects.USER32 ref: 0060F026
                                                                                            • Part of subcall function 0060EFD8: GetExitCodeProcess.KERNEL32 ref: 0060F037
                                                                                            • Part of subcall function 0060EFD8: CloseHandle.KERNEL32(00000001,0060F064,0060F05D,?,?,?,00000001,?,?,0060F406,?,00000000,0060F41C,?,?,?), ref: 0060F057
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
                                                                                          • String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
                                                                                          • API String ID: 854858120-615399546
                                                                                          • Opcode ID: 19013589fda6436252617202f5d3929bf5bce88842b433682b18a893cef81ff9
                                                                                          • Instruction ID: 0730013a778409a59d543d7128fc9cae65caf948aa4e6a3f37707057903c9a02
                                                                                          • Opcode Fuzzy Hash: 19013589fda6436252617202f5d3929bf5bce88842b433682b18a893cef81ff9
                                                                                          • Instruction Fuzzy Hash: 69512134A8030DABDB14EFE5C892ADEBBBAFF44304F60447AB404A76C1D7749E059B95
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B85F0 Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 244 5b85f0-5b860b PeekMessageW 245 5b86f9-5b8700 244->245 246 5b8611-5b8615 244->246 247 5b8617-5b861f IsWindowUnicode 246->247 248 5b8625 246->248 247->248 249 5b8621-5b8623 247->249 250 5b8627-5b8630 248->250 249->250 251 5b8648-5b865b PeekMessageA 250->251 252 5b8632-5b8646 PeekMessageW 250->252 253 5b865c-5b865e 251->253 252->253 253->245 254 5b8664-5b866a 253->254 255 5b86f2 254->255 256 5b8670-5b867c 254->256 255->245 257 5b868e-5b8699 call 5ba368 256->257 258 5b867e-5b8682 256->258 257->245 261 5b869b-5b86a6 call 5b8488 257->261 258->257 261->245 264 5b86a8-5b86ac 261->264 264->245 265 5b86ae-5b86b9 call 5b8340 264->265 265->245 268 5b86bb-5b86c6 call 5b8390 265->268 268->245 271 5b86c8-5b86d3 call 5b82f8 268->271 271->245 274 5b86d5-5b86e0 TranslateMessage 271->274 275 5b86ea-5b86f0 DispatchMessageA 274->275 276 5b86e2-5b86e8 DispatchMessageW 274->276 275->245 276->245
                                                                                          C-Code - Quality: 90%
                                                                                          			E005B85F0(void* __eax, void* __ecx, struct tagMSG* __edx) {
				char _v19;
				int _t10;
				char _t12;
				int _t13;
				void* _t14;
				int _t30;
				int _t32;
				MSG* _t43;
				void* _t44;
				char* _t46;

				_t43 = __edx;
				_t44 = __eax;
				_t32 = 0;
				_t10 = PeekMessageW(__edx, 0, 0, 0, 0); // executed
				if(_t10 != 0) {
					_v19 = _t12;
					if(_v19 == 0) {
						_t13 = PeekMessageA(_t43, 0, 0, 0, 1);
						asm("sbb eax, eax");
						_t14 = _t13 + 1;
					} else {
						_t30 = PeekMessageW(_t43, 0, 0, 0, 1); // executed
						asm("sbb eax, eax");
						_t14 = _t30 + 1;
					}
					if(_t14 != 0) {
						_t32 = 1;
						if(_t43->message == 0x12) {
							 *((char*)(_t44 + 0xbc)) = 1;
						} else {
							 *_t46 = 0;
							if( *((short*)(_t44 + 0x122)) != 0) {
								 *((intOrPtr*)(_t44 + 0x120))();
							}
							if(E005BA368(_t44, _t43) == 0 && E005B8488(_t44, _t43) == 0 &&  *_t46 == 0 && E005B8340(_t44, _t43) == 0 && E005B8390(_t44, _t43) == 0 && E005B82F8(_t44, _t43) == 0) {
								TranslateMessage(_t43);
								if(_v19 == 0) {
									DispatchMessageA(_t43);
								} else {
									DispatchMessageW(_t43); // executed
								}
							}
						}
					}
				}
				return _t32;
			}













                                                                                          0x005b85f5
                                                                                          0x005b85f7
                                                                                          0x005b85f9
                                                                                          0x005b8604
                                                                                          0x005b860b
                                                                                          0x005b8627
                                                                                          0x005b8630
                                                                                          0x005b8651
                                                                                          0x005b8659
                                                                                          0x005b865b
                                                                                          0x005b8632
                                                                                          0x005b863b
                                                                                          0x005b8643
                                                                                          0x005b8645
                                                                                          0x005b8645
                                                                                          0x005b865e
                                                                                          0x005b8664
                                                                                          0x005b866a
                                                                                          0x005b86f2
                                                                                          0x005b8670
                                                                                          0x005b8670
                                                                                          0x005b867c
                                                                                          0x005b8688
                                                                                          0x005b8688
                                                                                          0x005b8699
                                                                                          0x005b86d6
                                                                                          0x005b86e0
                                                                                          0x005b86eb
                                                                                          0x005b86e2
                                                                                          0x005b86e3
                                                                                          0x005b86e3
                                                                                          0x005b86e0
                                                                                          0x005b8699
                                                                                          0x005b866a
                                                                                          0x005b865e
                                                                                          0x005b8700

                                                                                          APIs
                                                                                          • PeekMessageW.USER32 ref: 005B8604
                                                                                          • IsWindowUnicode.USER32 ref: 005B8618
                                                                                          • PeekMessageW.USER32 ref: 005B863B
                                                                                          • PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 005B8651
                                                                                          • TranslateMessage.USER32 ref: 005B86D6
                                                                                          • DispatchMessageW.USER32 ref: 005B86E3
                                                                                          • DispatchMessageA.USER32 ref: 005B86EB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2190272339-0
                                                                                          • Opcode ID: 2f195b20c59e7edbc16b7d2fd048cba63cfdff170111f45a03f5aac70044babc
                                                                                          • Instruction ID: 67b3953643da56f9c200822127d0531685f000c00b35d7cfb42a732a483186e2
                                                                                          • Opcode Fuzzy Hash: 2f195b20c59e7edbc16b7d2fd048cba63cfdff170111f45a03f5aac70044babc
                                                                                          • Instruction Fuzzy Hash: 4921D83034478065EA312D2A1C15BFE9FDD6FF1B49F14545EF58197282CEA9F846C21E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC8CC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 102COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 77%
                                                                                          			E006AC8CC(long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char* _t40;
				intOrPtr _t41;
				int _t47;
				intOrPtr _t77;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t94;
				intOrPtr _t107;
				intOrPtr _t108;

				_t105 = __esi;
				_t104 = __edi;
				_t79 = __ebx;
				_t107 = _t108;
				_t80 = 6;
				do {
					_push(0);
					_push(0);
					_t80 = _t80 - 1;
				} while (_t80 != 0);
				_push(_t80);
				_push(__ebx);
				_push(_t107);
				_push(0x6aca22);
				_push( *[fs:eax]);
				 *[fs:eax] = _t108;
				E0060D530( &_v20, __ebx, __edx, __edi, __esi); // executed
				E0040A5A8(0x6d6530, _v20);
				_t81 =  *0x6d6530; // 0x24ae29c
				E0040B4C8( &_v24, _t81, L"Created temporary directory: ");
				E00616130(_v24, _t79, __edi, __esi);
				_t40 =  *0x6cdfdc; // 0x6d62e4
				if( *_t40 != 0) {
					_t77 =  *0x6d6530; // 0x24ae29c
					E0061583C(_t77);
				}
				_t41 =  *0x6d6530; // 0x24ae29c
				E005C4EA4(_t41,  &_v28);
				E0040B4C8( &_v8, L"_isetup", _v28);
				_t47 = CreateDirectoryW(E0040B278(_v8), 0); // executed
				if(_t47 == 0) {
					_t79 = GetLastError();
					E005CD508(0x3d,  &_v48, _v8);
					_v44 = _v48;
					E0042302C( &_v52, _t61, 0);
					_v40 = _v52;
					E005C857C(_t79,  &_v56);
					_v36 = _v56;
					E005CD4D8(0x81, 2,  &_v44,  &_v32);
					E00429008(_v32, 1);
					E004098C4();
				}
				E0062554C( &_v12);
				_t113 = _v12;
				if(_v12 != 0) {
					E0040B4C8( &_v16, L"\\_setup64.tmp", _v8);
					E006AC874(_v12, _t79, _v16, _t104, _t105, _t113); // executed
					E006255A4(_v16);
				}
				_pop(_t94);
				 *[fs:eax] = _t94;
				_push(E006ACA29);
				E0040A228( &_v56, 3);
				return E0040A228( &_v32, 7);
			}

























                                                                                          0x006ac8cc
                                                                                          0x006ac8cc
                                                                                          0x006ac8cc
                                                                                          0x006ac8cd
                                                                                          0x006ac8cf
                                                                                          0x006ac8d4
                                                                                          0x006ac8d4
                                                                                          0x006ac8d6
                                                                                          0x006ac8d8
                                                                                          0x006ac8d8
                                                                                          0x006ac8db
                                                                                          0x006ac8dc
                                                                                          0x006ac8df
                                                                                          0x006ac8e0
                                                                                          0x006ac8e5
                                                                                          0x006ac8e8
                                                                                          0x006ac8ee
                                                                                          0x006ac8fb
                                                                                          0x006ac903
                                                                                          0x006ac90e
                                                                                          0x006ac916
                                                                                          0x006ac91b
                                                                                          0x006ac923
                                                                                          0x006ac925
                                                                                          0x006ac92a
                                                                                          0x006ac92a
                                                                                          0x006ac932
                                                                                          0x006ac937
                                                                                          0x006ac947
                                                                                          0x006ac957
                                                                                          0x006ac95e
                                                                                          0x006ac965
                                                                                          0x006ac975
                                                                                          0x006ac97d
                                                                                          0x006ac989
                                                                                          0x006ac991
                                                                                          0x006ac999
                                                                                          0x006ac9a1
                                                                                          0x006ac9b0
                                                                                          0x006ac9bf
                                                                                          0x006ac9c4
                                                                                          0x006ac9c4
                                                                                          0x006ac9cc
                                                                                          0x006ac9d1
                                                                                          0x006ac9d5
                                                                                          0x006ac9e2
                                                                                          0x006ac9ed
                                                                                          0x006ac9f5
                                                                                          0x006ac9f5
                                                                                          0x006ac9fc
                                                                                          0x006ac9ff
                                                                                          0x006aca02
                                                                                          0x006aca0f
                                                                                          0x006aca21

                                                                                          APIs
                                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,006ACA22,?,?,00000005,00000000,00000000,?,006B92B5,00000000,006B946A,?,00000000,006B94CE), ref: 006AC957
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,006ACA22,?,?,00000005,00000000,00000000,?,006B92B5,00000000,006B946A,?,00000000,006B94CE), ref: 006AC960
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: Created temporary directory: $\_setup64.tmp$_isetup$bm
                                                                                          • API String ID: 1375471231-4222912607
                                                                                          • Opcode ID: d1c4e1c7fab6d49092109dc432ba6fefba7ae3886913186320c74fc773a6ac9f
                                                                                          • Instruction ID: fab29f73b12df9647497e51388a78cad5e0a4b86d3a417c00642db4583a337af
                                                                                          • Opcode Fuzzy Hash: d1c4e1c7fab6d49092109dc432ba6fefba7ae3886913186320c74fc773a6ac9f
                                                                                          • Instruction Fuzzy Hash: 00412E34A102099BDB01FBA4D891AEEB7B6FF89704F50417AF501B7391DA34AE458B64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C92C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowregistryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 70%
                                                                                          			E005C92C8(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t10;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t27;
				struct HWND__* _t33;
				void* _t42;
				intOrPtr _t44;
				void* _t49;
				intOrPtr _t51;
				struct HWND__* _t52;
				intOrPtr _t54;
				intOrPtr _t55;

				_t50 = __esi;
				_t42 = __edx;
				_t54 = _t55;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(__edx != 0) {
					_t55 = _t55 + 0xfffffff0;
					_t10 = E00408A40(_t10, _t54);
				}
				_t49 = _t10;
				_push(_t54);
				_push(0x5c93da);
				_push( *[fs:eax]);
				 *[fs:eax] = _t55;
				E00408414(0);
				 *((intOrPtr*)(_t49 + 0xc)) = GetActiveWindow();
				 *((intOrPtr*)(_t49 + 0x10)) = GetFocus();
				_t17 = E005ABB4C(0, _t42, _t49, _t50); // executed
				 *((intOrPtr*)(_t49 + 0x14)) = _t17;
				if( *0x6d5822 == 0) {
					 *0x6d5822 = RegisterClassW(0x6ccd0c);
				}
				if( *0x6d5822 != 0) {
					_t22 =  *0x6d2634; // 0x400000
					_t24 = E00414DA0(0, L"TWindowDisabler-Window", 0, _t22, 0, 0, 0, 0, 0, 0, 0x88000000); // executed
					_t51 = _t24;
					 *((intOrPtr*)(_t49 + 8)) = _t51;
					if(_t51 != 0) {
						_t5 = _t49 + 8; // 0x4134a000
						_t26 =  *0x6d2634; // 0x400000
						_t27 =  *0x6cdec4; // 0x6d579c
						E005B8044( *_t27,  &_v8);
						E0040B278(_v8);
						_t33 = E00414DA0(0, L"TWindowDisabler-Window", 0, _t26, 0,  *_t5, 0, 0, 0, 0, 0x80000000); // executed
						_t52 = _t33;
						 *(_t49 + 4) = _t52;
						if(_t52 != 0) {
							ShowWindow(_t52, 8); // executed
						}
					}
				}
				SetFocus(0);
				_pop(_t44);
				 *[fs:eax] = _t44;
				_push(E005C93E1);
				return E0040A1C8( &_v8);
			}


















                                                                                          0x005c92c8
                                                                                          0x005c92c8
                                                                                          0x005c92c9
                                                                                          0x005c92cb
                                                                                          0x005c92cd
                                                                                          0x005c92ce
                                                                                          0x005c92cf
                                                                                          0x005c92d2
                                                                                          0x005c92d4
                                                                                          0x005c92d7
                                                                                          0x005c92d7
                                                                                          0x005c92de
                                                                                          0x005c92e2
                                                                                          0x005c92e3
                                                                                          0x005c92e8
                                                                                          0x005c92eb
                                                                                          0x005c92f2
                                                                                          0x005c92fc
                                                                                          0x005c9304
                                                                                          0x005c9309
                                                                                          0x005c930e
                                                                                          0x005c9319
                                                                                          0x005c9325
                                                                                          0x005c9325
                                                                                          0x005c9333
                                                                                          0x005c934a
                                                                                          0x005c935e
                                                                                          0x005c9363
                                                                                          0x005c9365
                                                                                          0x005c936a
                                                                                          0x005c9379
                                                                                          0x005c937f
                                                                                          0x005c938a
                                                                                          0x005c9391
                                                                                          0x005c9399
                                                                                          0x005c93a7
                                                                                          0x005c93ac
                                                                                          0x005c93ae
                                                                                          0x005c93b3
                                                                                          0x005c93b8
                                                                                          0x005c93b8
                                                                                          0x005c93b3
                                                                                          0x005c936a
                                                                                          0x005c93bf
                                                                                          0x005c93c6
                                                                                          0x005c93c9
                                                                                          0x005c93cc
                                                                                          0x005c93d9

                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 005C92F7
                                                                                          • GetFocus.USER32(00000000,005C93DA,?,?,?,00000001,00000000,?,00624EAB,006D579C,?,006B93C5,?,?,00000000,006B9450), ref: 005C92FF
                                                                                          • RegisterClassW.USER32 ref: 005C9320
                                                                                          • ShowWindow.USER32(00000000,00000008,00000000,00400000,00000000,4134A000,00000000,00000000,00000000,00000000,80000000,00000000,00400000,00000000,00000000,00000000), ref: 005C93B8
                                                                                          • SetFocus.USER32(00000000,00000000,005C93DA,?,?,?,00000001,00000000,?,00624EAB,006D579C,?,006B93C5,?,?,00000000), ref: 005C93BF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FocusWindow$ActiveClassRegisterShow
                                                                                          • String ID: TWindowDisabler-Window
                                                                                          • API String ID: 495420250-1824977358
                                                                                          • Opcode ID: 30f155d690f4f9d5015497ee0a3f395b616b2bef4b75741531dfc9167d15d398
                                                                                          • Instruction ID: 15dfa4f4c92537cee7ed1e4bf608ea9bac44f034fc845b592ccaf34af6f1c1de
                                                                                          • Opcode Fuzzy Hash: 30f155d690f4f9d5015497ee0a3f395b616b2bef4b75741531dfc9167d15d398
                                                                                          • Instruction Fuzzy Hash: 1321E570A41700AFD710EBA59C56F5ABBA5FB85B00F51452DF900EB6D1EB78AC40C7D8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006C4660 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 65%
                                                                                          			_entry_() {
				intOrPtr* _t12;
				signed int _t15;
				intOrPtr _t21;
				intOrPtr* _t22;
				intOrPtr* _t28;
				intOrPtr* _t31;
				intOrPtr* _t35;
				intOrPtr _t36;
				void* _t61;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr _t77;
				intOrPtr _t79;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t83;
				void* _t84;
				void* _t86;
				intOrPtr* _t88;
				intOrPtr _t89;
				void* _t90;
				intOrPtr _t92;
				void* _t93;

				E00410BA8(0x6b9a98);
				_t12 =  *0x6cdec4; // 0x6d579c
				_t15 = GetWindowLongW( *( *_t12 + 0x188), 0xffffffec);
				_t73 =  *0x6cdec4; // 0x6d579c
				SetWindowLongW( *( *_t73 + 0x188), 0xffffffec, _t15 & 0xffffff7f); // executed
				_push(_t88);
				_push(0x6c46f1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				SetErrorMode(1); // executed
				E006B9800(_t90);
				_t21 =  *0x6b96c0; // 0x6b9718
				_t22 =  *0x6cdec4; // 0x6d579c
				E005B8740( *_t22, E006B9758, _t21);
				_t76 =  *0x6cdd3c; // 0x6d57d8
				 *_t76 = 0x6b4380;
				E006B9870(_t62, _t84, _t86, _t90, _t93);
				_pop(_t77);
				 *[fs:eax] = _t77;
				_t28 =  *0x6cdec4; // 0x6d579c
				E005B8250( *_t28, L"Setup", _t90);
				_t31 =  *0x6cdec4; // 0x6d579c
				ShowWindow( *( *_t31 + 0x188), 5);
				_t35 =  *0x6cdec4; // 0x6d579c
				_t36 =  *_t35;
				_t79 =  *0x6a6ef4; // 0x6a6f4c
				 *((intOrPtr*)(_t36 + 0x10c)) = _t79;
				 *((intOrPtr*)(_t36 + 0x108)) = 0x6b3994;
				_push(_t88);
				_push(0x6c479a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				E005B881C(); // executed
				L006B09B0(_t62, _t84, _t86, _t93);
				L005B8834( *((intOrPtr*)( *0x6cdec4)), _t62,  *0x6cdab4,  *0x6a6ef4, _t84, _t86);
				L006B3B64(_t90, _t93);
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(_t88);
				_push(0x6c481d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				L005B8990( *((intOrPtr*)( *0x6cdec4)), _t62, _t84, _t86);
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(_t88);
				_push(0x6c4854);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				L006B2AB0( *0x6cdcd4 & 0xffffff00 |  *( *0x6cdcd4) == 0x00000000, _t62, _t84, _t86,  *( *0x6cdcd4));
				_pop(_t83);
				 *[fs:eax] = _t83;
				_t61 = L0040A028( *( *0x6cdcd4));
				L00409EF8();
				 *((intOrPtr*)(_t61 - 0xfffdfc)) =  *((intOrPtr*)(_t61 - 0xfffdfc)) + _t83;
				asm("invalid");
				 *0x53000000 =  *0x53000000 + 1;
				 *_t88 =  *_t88 + _t61;
				_t92 =  *_t88;
				if (_t92 == 0) goto L5;
				if (_t92 != 0) goto L6;
				if (_t92 < 0) goto 0x6c488e;
			}



























                                                                                          0x006c466e
                                                                                          0x006c4673
                                                                                          0x006c4683
                                                                                          0x006c4688
                                                                                          0x006c469f
                                                                                          0x006c46a6
                                                                                          0x006c46a7
                                                                                          0x006c46ac
                                                                                          0x006c46af
                                                                                          0x006c46b4
                                                                                          0x006c46b9
                                                                                          0x006c46be
                                                                                          0x006c46c9
                                                                                          0x006c46d0
                                                                                          0x006c46da
                                                                                          0x006c46e0
                                                                                          0x006c46e2
                                                                                          0x006c46e9
                                                                                          0x006c46ec
                                                                                          0x006c470a
                                                                                          0x006c4716
                                                                                          0x006c471d
                                                                                          0x006c472b
                                                                                          0x006c4730
                                                                                          0x006c4735
                                                                                          0x006c4737
                                                                                          0x006c473d
                                                                                          0x006c4743
                                                                                          0x006c474f
                                                                                          0x006c4750
                                                                                          0x006c4755
                                                                                          0x006c4758
                                                                                          0x006c4762
                                                                                          0x006c4767
                                                                                          0x006c477f
                                                                                          0x006c478b
                                                                                          0x006c4792
                                                                                          0x006c4795
                                                                                          0x006c47fb
                                                                                          0x006c47fc
                                                                                          0x006c4801
                                                                                          0x006c4804
                                                                                          0x006c480e
                                                                                          0x006c4815
                                                                                          0x006c4818
                                                                                          0x006c482e
                                                                                          0x006c482f
                                                                                          0x006c4834
                                                                                          0x006c4837
                                                                                          0x006c4845
                                                                                          0x006c484c
                                                                                          0x006c484f
                                                                                          0x006c486a
                                                                                          0x006c4872
                                                                                          0x006c4877
                                                                                          0x006c487d
                                                                                          0x006c487f
                                                                                          0x006c4885
                                                                                          0x006c4885
                                                                                          0x006c4888
                                                                                          0x006c488a
                                                                                          0x006c488c

                                                                                          APIs
                                                                                            • Part of subcall function 00410BA8: GetModuleHandleW.KERNEL32(00000000,?,006C4673), ref: 00410BB4
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 006C4683
                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 006C469F
                                                                                          • SetErrorMode.KERNEL32(00000001,00000000,006C46F1), ref: 006C46B4
                                                                                            • Part of subcall function 006B9800: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,006C46BE,00000001,00000000,006C46F1), ref: 006B980A
                                                                                            • Part of subcall function 005B8740: SendMessageW.USER32(?,0000B020,00000000,?), ref: 005B8765
                                                                                            • Part of subcall function 005B8250: SetWindowTextW.USER32(?,00000000), ref: 005B8281
                                                                                          • ShowWindow.USER32(?,00000005,00000000,006C46F1), ref: 006C472B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$HandleLongModule$ErrorMessageModeSendShowText
                                                                                          • String ID: Loj$Setup
                                                                                          • API String ID: 1533765661-1180797960
                                                                                          • Opcode ID: 3d0304c784d3bd607acd89935b1016d88a71efec8a9d6f2a7abca0b2f7454e11
                                                                                          • Instruction ID: d4d45baa3e9a68820d1f8b3b63154724c7fffc608bd47f906fb52fcab16a7fb3
                                                                                          • Opcode Fuzzy Hash: 3d0304c784d3bd607acd89935b1016d88a71efec8a9d6f2a7abca0b2f7454e11
                                                                                          • Instruction Fuzzy Hash: BE216D782046009FD700EF29DC91DA67BFAEB9E71071145B8F9008B3A2CE74BC80CB64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005CE26C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 51%
                                                                                          			E005CE26C(void* __eax, void* __ebx, long* __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				struct HDC__* _v8;
				struct tagSIZE _v16;
				struct tagTEXTMETRICW _v76;
				signed int _t26;
				signed int _t27;
				void* _t36;
				intOrPtr _t43;
				long* _t45;
				signed int* _t47;
				void* _t50;

				_t37 = __ecx;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t45 = __ecx;
				_t47 = __edx;
				_t36 = __eax;
				_v8 = GetDC(0);
				_push(_t50);
				_push(0x5ce2f8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50 + 0xffffffb8;
				SelectObject(_v8, E004EE238(_t36, _t36, _t37, _t45, _t47));
				GetTextExtentPointW(_v8, L"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", 0x34,  &_v16); // executed
				asm("cdq");
				_t26 = _v16.cx / 0x1a + 1;
				_t27 = _t26 >> 1;
				if(_t26 < 0) {
					asm("adc eax, 0x0");
				}
				 *_t47 = _t27;
				GetTextMetricsW(_v8,  &_v76);
				 *_t45 = _v76.tmHeight;
				_pop(_t43);
				 *[fs:eax] = _t43;
				_push(E005CE2FF);
				return ReleaseDC(0, _v8);
			}













                                                                                          0x005ce26c
                                                                                          0x005ce272
                                                                                          0x005ce273
                                                                                          0x005ce274
                                                                                          0x005ce275
                                                                                          0x005ce277
                                                                                          0x005ce279
                                                                                          0x005ce282
                                                                                          0x005ce287
                                                                                          0x005ce288
                                                                                          0x005ce28d
                                                                                          0x005ce290
                                                                                          0x005ce29f
                                                                                          0x005ce2b3
                                                                                          0x005ce2c0
                                                                                          0x005ce2c3
                                                                                          0x005ce2c4
                                                                                          0x005ce2c6
                                                                                          0x005ce2c8
                                                                                          0x005ce2c8
                                                                                          0x005ce2cb
                                                                                          0x005ce2d5
                                                                                          0x005ce2dd
                                                                                          0x005ce2e1
                                                                                          0x005ce2e4
                                                                                          0x005ce2e7
                                                                                          0x005ce2f7

                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 005CE27D
                                                                                            • Part of subcall function 004EE238: EnterCriticalSection.KERNEL32(?,00000000,004EE4A7,?,?), ref: 004EE280
                                                                                          • SelectObject.GDI32(00000001,00000000), ref: 005CE29F
                                                                                          • GetTextExtentPointW.GDI32(00000001,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005CE2B3
                                                                                          • GetTextMetricsW.GDI32(00000001,?,00000000,005CE2F8,?,00000000,?,0068D5D0,00000001), ref: 005CE2D5
                                                                                          • ReleaseDC.USER32 ref: 005CE2F2
                                                                                          Strings
                                                                                          • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 005CE2AA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
                                                                                          • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
                                                                                          • API String ID: 1334710084-222967699
                                                                                          • Opcode ID: 325bd83ac94b98e0ccaeb91b867b8168358bc3f43770baf6a1d651e33ba30b3f
                                                                                          • Instruction ID: 68d2e7468c57547273e36bf030651d7f5f3d68c5ac32077f2b8cb66f1dd3ef54
                                                                                          • Opcode Fuzzy Hash: 325bd83ac94b98e0ccaeb91b867b8168358bc3f43770baf6a1d651e33ba30b3f
                                                                                          • Instruction Fuzzy Hash: 8E01847AA14204BFE704DEE9CC42F9EB7ECEB49704F510469F604E7280D678AD008724
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00423A20 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 367 423a20-423a3d call 40b278 DeleteFileW 370 423a75-423a7b 367->370 371 423a3f-423a4f GetLastError GetFileAttributesW 367->371 372 423a51-423a54 371->372 373 423a6f-423a70 SetLastError 371->373 372->373 374 423a56-423a58 372->374 373->370 374->373 375 423a5a-423a6d call 40b278 RemoveDirectoryW 374->375 375->370
                                                                                          C-Code - Quality: 82%
                                                                                          			E00423A20(void* __eax) {
				signed char _t10;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t17;
				WCHAR* _t18;

				_t17 = __eax;
				_t18 = E0040B278(__eax);
				DeleteFileW(_t18); // executed
				asm("sbb ebx, ebx");
				_t15 = _t14 + 1;
				if(_t15 == 0) {
					_t16 = GetLastError();
					_t10 = GetFileAttributesW(_t18); // executed
					if(_t10 == 0xffffffff || (_t10 & 0x00000004) == 0 || (_t10 & 0x00000010) == 0) {
						SetLastError(_t16);
					} else {
						RemoveDirectoryW(E0040B278(_t17));
						asm("sbb ebx, ebx");
						_t15 = _t15 + 1;
					}
				}
				return _t15;
			}









                                                                                          0x00423a24
                                                                                          0x00423a2d
                                                                                          0x00423a30
                                                                                          0x00423a38
                                                                                          0x00423a3a
                                                                                          0x00423a3d
                                                                                          0x00423a44
                                                                                          0x00423a47
                                                                                          0x00423a4f
                                                                                          0x00423a70
                                                                                          0x00423a5a
                                                                                          0x00423a62
                                                                                          0x00423a6a
                                                                                          0x00423a6c
                                                                                          0x00423a6c
                                                                                          0x00423a4f
                                                                                          0x00423a7b

                                                                                          APIs
                                                                                          • DeleteFileW.KERNEL32(00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A30
                                                                                          • GetLastError.KERNEL32(00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A3F
                                                                                          • GetFileAttributesW.KERNEL32(00000000,00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000), ref: 00423A47
                                                                                          • RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000), ref: 00423A62
                                                                                          • SetLastError.KERNEL32(00000000,00000000,00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000), ref: 00423A70
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
                                                                                          • String ID:
                                                                                          • API String ID: 2814369299-0
                                                                                          • Opcode ID: f8eb1e274ae0da30ec15d3940c6dffd0d89611f214c75bb691a3e156c1598d1a
                                                                                          • Instruction ID: b6ddb16581f5c3c7179c90d7d3f79c6d55466118c1baf1b24a27a0798ed1e7de
                                                                                          • Opcode Fuzzy Hash: f8eb1e274ae0da30ec15d3940c6dffd0d89611f214c75bb691a3e156c1598d1a
                                                                                          • Instruction Fuzzy Hash: FAF0A7613803241999203DBE28C9ABF115CC9427AFB54077FF994D22D2D62D5F87415D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060C038 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60processCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 378 60c038-60c053 call 60bf74 381 60c055-60c0cb 378->381 382 60c05c-60c0ac CreateProcessW GetLastError call 60bfb0 378->382 385 60c0b1 382->385
                                                                                          C-Code - Quality: 65%
                                                                                          			E0060C038(void* __eax, WCHAR* __ecx, WCHAR* __edx, void* __eflags, struct _PROCESS_INFORMATION* _a4, struct _STARTUPINFOW* _a8, char _a12, void* _a16, char _a20, int _a24, struct _SECURITY_ATTRIBUTES* _a28, struct _SECURITY_ATTRIBUTES* _a32) {
				int _v8;
				char _v16;
				long _v20;
				int _t27;
				intOrPtr _t42;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t50 = _t52;
				_t53 = _t52 + 0xfffffff0;
				if(E0060BF74(__eax,  &_v16) != 0) {
					_push(_t50);
					_push(0x60c0b2);
					_push( *[fs:eax]);
					 *[fs:eax] = _t53;
					_t5 =  &_a12; // 0x624d3e
					_t7 =  &_a20; // 0x624d58
					_t27 = CreateProcessW(__edx, __ecx, _a32, _a28, _a24,  *_t7, _a16,  *_t5, _a8, _a4); // executed
					_v8 = _t27;
					_v20 = GetLastError();
					_pop(_t42);
					 *[fs:eax] = _t42;
					_push(E0060C0B9);
					return E0060BFB0( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}











                                                                                          0x0060c039
                                                                                          0x0060c03b
                                                                                          0x0060c053
                                                                                          0x0060c05e
                                                                                          0x0060c05f
                                                                                          0x0060c064
                                                                                          0x0060c067
                                                                                          0x0060c072
                                                                                          0x0060c07a
                                                                                          0x0060c08c
                                                                                          0x0060c091
                                                                                          0x0060c099
                                                                                          0x0060c09e
                                                                                          0x0060c0a1
                                                                                          0x0060c0a4
                                                                                          0x0060c0b1
                                                                                          0x0060c055
                                                                                          0x0060c057
                                                                                          0x0060c0cb
                                                                                          0x0060c0cb

                                                                                          APIs
                                                                                          • CreateProcessW.KERNEL32 ref: 0060C08C
                                                                                          • GetLastError.KERNEL32(00000000,00000000,006D579C,?,?,XMb,00000000,>Mb,?,?,00000000,0060C0B2,?,?,?,00000001), ref: 0060C094
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateErrorLastProcess
                                                                                          • String ID: >Mb$XMb
                                                                                          • API String ID: 2919029540-2660256435
                                                                                          • Opcode ID: fc70ad85d2157d21ba367755dea5396487fa079e60854658823ca55dcf81e298
                                                                                          • Instruction ID: 6fed8a1d79b3fe7fb7c31d778b9d5703ccb9eb2a1393ada51090ba1ca1dee2d9
                                                                                          • Opcode Fuzzy Hash: fc70ad85d2157d21ba367755dea5396487fa079e60854658823ca55dcf81e298
                                                                                          • Instruction Fuzzy Hash: DA113972640208AFCB54DFA9DC81DDFB7ECEB4D320B518666F908D3280D635AE108BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004785F8 Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 415 4785f8-478626 GetClassInfoW 416 478632-478634 415->416 417 478628-478630 415->417 419 478647-47864c RegisterClassW 416->419 420 478636-478642 UnregisterClassW 416->420 417->416 418 478651-478686 call 414da0 417->418 423 47869c-4786a2 418->423 424 478688-47868e call 47845c 418->424 419->418 420->419 426 478693-478697 SetWindowLongW 424->426 426->423
                                                                                          C-Code - Quality: 94%
                                                                                          			E004785F8(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSW _v44;
				struct HINSTANCE__* _t6;
				WCHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HWND__* _t15;
				long _t17;
				struct HINSTANCE__* _t19;
				WCHAR* _t20;
				struct HWND__* _t22;
				WCHAR* _t24;

				_t6 =  *0x6d2634; // 0x400000
				 *0x6c7aa8 = _t6;
				_t8 =  *0x6c7abc; // 0x4785dc
				_t9 =  *0x6d2634; // 0x400000
				_t10 = GetClassInfoW(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L00414778 != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x6d2634; // 0x400000
						_t20 =  *0x6c7abc; // 0x4785dc
						UnregisterClassW(_t20, _t19);
					}
					RegisterClassW(0x6c7a98);
				}
				_t13 =  *0x6d2634; // 0x400000
				_t24 =  *0x6c7abc; // 0x4785dc
				_t15 = E00414DA0(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000); // executed
				_t22 = _t15;
				if(_a6 != 0) {
					_t17 = E0047845C(_a4, _a8); // executed
					SetWindowLongW(_t22, 0xfffffffc, _t17);
				}
				return _t22;
			}
















                                                                                          0x004785ff
                                                                                          0x00478604
                                                                                          0x0047860d
                                                                                          0x00478613
                                                                                          0x00478619
                                                                                          0x00478621
                                                                                          0x00478623
                                                                                          0x00478626
                                                                                          0x00478634
                                                                                          0x00478636
                                                                                          0x0047863c
                                                                                          0x00478642
                                                                                          0x00478642
                                                                                          0x0047864c
                                                                                          0x0047864c
                                                                                          0x00478662
                                                                                          0x0047866f
                                                                                          0x0047867a
                                                                                          0x0047867f
                                                                                          0x00478686
                                                                                          0x0047868e
                                                                                          0x00478697
                                                                                          0x00478697
                                                                                          0x004786a2

                                                                                          APIs
                                                                                          • GetClassInfoW.USER32 ref: 00478619
                                                                                          • UnregisterClassW.USER32 ref: 00478642
                                                                                          • RegisterClassW.USER32 ref: 0047864C
                                                                                          • SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 00478697
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Class$InfoLongRegisterUnregisterWindow
                                                                                          • String ID:
                                                                                          • API String ID: 4025006896-0
                                                                                          • Opcode ID: c13718059519df6099dbd22287901c2cd341ee5024df696f59e832b4f8273898
                                                                                          • Instruction ID: 194e1b82028893281538589df9a22bcce55ada3cdaffe31495447ecbac098301
                                                                                          • Opcode Fuzzy Hash: c13718059519df6099dbd22287901c2cd341ee5024df696f59e832b4f8273898
                                                                                          • Instruction Fuzzy Hash: D501C4716452057BCB10EB98EC85FDF739EE758314F10811AF508E7391CA39E9418BA8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060EFD8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 427 60efd8-60effa 428 60f010-60f013 427->428 429 60effc-60f00e WaitForInputIdle 427->429 430 60f032-60f03e GetExitCodeProcess 428->430 431 60f015-60f02e MsgWaitForMultipleObjects 428->431 429->428 433 60f040 430->433 434 60f046-60f05c CloseHandle 430->434 436 60f030 431->436 433->434 436->430
                                                                                          APIs
                                                                                          • WaitForInputIdle.USER32 ref: 0060F004
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 0060F026
                                                                                          • GetExitCodeProcess.KERNEL32 ref: 0060F037
                                                                                          • CloseHandle.KERNEL32(00000001,0060F064,0060F05D,?,?,?,00000001,?,?,0060F406,?,00000000,0060F41C,?,?,?), ref: 0060F057
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
                                                                                          • String ID:
                                                                                          • API String ID: 4071923889-0
                                                                                          • Opcode ID: b2c0e9a815401a59890ae953dc8cc514a32d7d884ad163320893ed3959533c1a
                                                                                          • Instruction ID: 3bf9388a4eab4805cc6f518967bcd8e0b9f61bd1b59095cebcc575be48bbaf87
                                                                                          • Opcode Fuzzy Hash: b2c0e9a815401a59890ae953dc8cc514a32d7d884ad163320893ed3959533c1a
                                                                                          • Instruction Fuzzy Hash: 24012D70A80308BEEB3497A58D16FEBBBADDF45760F510536F604C36C2D5759D40C664
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AE3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158windowCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          C-Code - Quality: 100%
                                                                                          			E006AE3C8(long __eax, void* __ecx, void* __fp0) {
				void* __ebx;
				void* __ebp;
				long _t23;
				intOrPtr _t24;
				intOrPtr _t28;
				intOrPtr _t49;
				intOrPtr _t54;
				intOrPtr _t59;
				intOrPtr _t64;
				intOrPtr* _t69;
				struct HWND__* _t72;
				int _t73;
				intOrPtr _t74;
				void* _t77;
				void* _t79;
				void* _t93;
				void* _t94;
				void* _t95;
				intOrPtr _t98;
				void* _t100;
				intOrPtr _t104;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t113;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				long _t126;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t147;

				_t147 = __fp0;
				_t95 = __ecx;
				_t23 = __eax;
				_t126 = __eax;
				_t131 = _t126 -  *0x6cd738; // 0x0
				if(_t131 == 0) {
					L28:
					return _t23;
				}
				_t24 =  *0x6d66f8; // 0x24e3d50
				_t93 = E00464CD0(_t24, __eax);
				_t1 = _t93 + 0x18; // 0x18
				_t100 = E0040A77C(_t1);
				_t28 =  *((intOrPtr*)(_t93 + 0x18));
				if(_t28 != 0) {
					_t28 =  *((intOrPtr*)(_t28 - 4));
				}
				E005CD600(_t100, _t95, _t28);
				E005C77C4();
				E005C77C4();
				 *0x6cd738 = _t126;
				_t104 =  *0x5cac34; // 0x5cac38
				E0040BFAC(0x6d66b8, _t104);
				_t98 =  *0x5cac34; // 0x5cac38
				E0040C278(0x6d66b8, _t98, _t93, _t147);
				if( *0x6d66e0 == 0x411 &&  *0x6d67f0 < 0x5010000 && E005C7F8C(L"MS PGothic", _t93) != 0) {
					E0040A5A8(0x6d66c8, L"MS PGothic");
					 *0x6d66ec = 0xc;
				}
				if( *((intOrPtr*)(_t93 + 0x1c)) == 0) {
					_t106 =  *0x6d6601; // 0x0
					E0040A644(0x6d6744, _t106);
				} else {
					E0040A644(0x6d6744,  *((intOrPtr*)(_t93 + 0x1c)));
				}
				if( *((intOrPtr*)(_t93 + 0x20)) == 0) {
					_t107 =  *0x6d6605; // 0x0
					E0040A644(0x6d6748, _t107);
				} else {
					E0040A644(0x6d6748,  *((intOrPtr*)(_t93 + 0x20)));
				}
				_t139 =  *((intOrPtr*)(_t93 + 0x24));
				if( *((intOrPtr*)(_t93 + 0x24)) == 0) {
					_t108 =  *0x6d6609; // 0x0
					E0040A644(0x6d674c, _t108);
				} else {
					E0040A644(0x6d674c,  *((intOrPtr*)(_t93 + 0x24)));
				}
				E005C9044( *0x6d66f4 & 0x000000ff);
				_t49 =  *0x6cded8; // 0x6d5c28
				_t10 = _t49 + 0x1e8; // 0x24f86cc
				E005C8FB8(0, _t98, E0040B278( *_t10), _t139);
				_t54 =  *0x6cded8; // 0x6d5c28
				_t11 = _t54 + 0xb0; // 0x24db00c
				E005C8FB8(1, _t98, E0040B278( *_t11), _t139);
				_t59 =  *0x6cded8; // 0x6d5c28
				_t12 = _t59 + 0x164; // 0x24db02c
				E005C8FB8(2, _t98, E0040B278( *_t12), _t139);
				_t64 =  *0x6cded8; // 0x6d5c28
				_t13 = _t64 + 0x164; // 0x24db02c
				E005C8FB8(3, _t98, E0040B278( *_t13), _t139);
				_t113 =  *0x6cded8; // 0x6d5c28
				_t14 = _t113 + 0x2f8; // 0x24db0ac
				_t69 =  *0x6cdec4; // 0x6d579c
				E005B8250( *_t69,  *_t14, _t139);
				_t23 =  *0x6d6704; // 0x24e3d98
				_t128 =  *((intOrPtr*)(_t23 + 8)) - 1;
				if(_t128 < 0) {
					L26:
					if( *0x6d64a4 == 0) {
						goto L28;
					}
					_t72 =  *0x6d64a8; // 0x140394
					_t73 = SendNotifyMessageW(_t72, 0x496, 0x2711, _t126); // executed
					return _t73;
				} else {
					_t129 = _t128 + 1;
					_t130 = 0;
					do {
						_t74 =  *0x6d6704; // 0x24e3d98
						_t94 = E00464CD0(_t74, _t130);
						_t77 = ( *(_t94 + 0x25) & 0x000000ff) - 1;
						if(_t77 == 0) {
							_t17 = _t94 + 4; // 0x4
							_t116 =  *0x6cded8; // 0x6d5c28
							_t18 = _t116 + 0x1c8; // 0x251554c
							_t23 = E0040A5A8(_t17,  *_t18);
						} else {
							_t79 = _t77 - 1;
							if(_t79 == 0) {
								_t19 = _t94 + 4; // 0x4
								_t118 =  *0x6cded8; // 0x6d5c28
								_t20 = _t118 + 0x94; // 0x2523a1c
								_t23 = E0040A5A8(_t19,  *_t20);
							} else {
								_t23 = _t79 - 1;
								if(_t23 == 0) {
									_t21 = _t94 + 4; // 0x4
									_t120 =  *0x6cded8; // 0x6d5c28
									_t22 = _t120 + 0xb8; // 0x251546c
									_t23 = E0040A5A8(_t21,  *_t22);
								}
							}
						}
						_t130 = _t130 + 1;
						_t129 = _t129 - 1;
					} while (_t129 != 0);
					goto L26;
				}
			}





































                                                                                          0x006ae3c8
                                                                                          0x006ae3c8
                                                                                          0x006ae3c8
                                                                                          0x006ae3cc
                                                                                          0x006ae3ce
                                                                                          0x006ae3d4
                                                                                          0x006ae621
                                                                                          0x006ae621
                                                                                          0x006ae621
                                                                                          0x006ae3dc
                                                                                          0x006ae3e6
                                                                                          0x006ae3e8
                                                                                          0x006ae3f0
                                                                                          0x006ae3f2
                                                                                          0x006ae3f7
                                                                                          0x006ae3fc
                                                                                          0x006ae3fc
                                                                                          0x006ae3ff
                                                                                          0x006ae413
                                                                                          0x006ae427
                                                                                          0x006ae42c
                                                                                          0x006ae437
                                                                                          0x006ae43d
                                                                                          0x006ae449
                                                                                          0x006ae44f
                                                                                          0x006ae45e
                                                                                          0x006ae484
                                                                                          0x006ae489
                                                                                          0x006ae489
                                                                                          0x006ae497
                                                                                          0x006ae4ad
                                                                                          0x006ae4b3
                                                                                          0x006ae499
                                                                                          0x006ae4a1
                                                                                          0x006ae4a1
                                                                                          0x006ae4bc
                                                                                          0x006ae4d2
                                                                                          0x006ae4d8
                                                                                          0x006ae4be
                                                                                          0x006ae4c6
                                                                                          0x006ae4c6
                                                                                          0x006ae4dd
                                                                                          0x006ae4e1
                                                                                          0x006ae4f7
                                                                                          0x006ae4fd
                                                                                          0x006ae4e3
                                                                                          0x006ae4eb
                                                                                          0x006ae4eb
                                                                                          0x006ae509
                                                                                          0x006ae50e
                                                                                          0x006ae513
                                                                                          0x006ae522
                                                                                          0x006ae527
                                                                                          0x006ae52c
                                                                                          0x006ae53b
                                                                                          0x006ae540
                                                                                          0x006ae545
                                                                                          0x006ae554
                                                                                          0x006ae559
                                                                                          0x006ae55e
                                                                                          0x006ae56d
                                                                                          0x006ae572
                                                                                          0x006ae578
                                                                                          0x006ae57e
                                                                                          0x006ae585
                                                                                          0x006ae58a
                                                                                          0x006ae592
                                                                                          0x006ae595
                                                                                          0x006ae5fe
                                                                                          0x006ae605
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006ae612
                                                                                          0x006ae618
                                                                                          0x00000000
                                                                                          0x006ae597
                                                                                          0x006ae597
                                                                                          0x006ae598
                                                                                          0x006ae59a
                                                                                          0x006ae59c
                                                                                          0x006ae5a6
                                                                                          0x006ae5ac
                                                                                          0x006ae5ae
                                                                                          0x006ae5ba
                                                                                          0x006ae5bd
                                                                                          0x006ae5c3
                                                                                          0x006ae5c9
                                                                                          0x006ae5b0
                                                                                          0x006ae5b0
                                                                                          0x006ae5b2
                                                                                          0x006ae5d0
                                                                                          0x006ae5d3
                                                                                          0x006ae5d9
                                                                                          0x006ae5df
                                                                                          0x006ae5b4
                                                                                          0x006ae5b4
                                                                                          0x006ae5b6
                                                                                          0x006ae5e6
                                                                                          0x006ae5e9
                                                                                          0x006ae5ef
                                                                                          0x006ae5f5
                                                                                          0x006ae5f5
                                                                                          0x006ae5b6
                                                                                          0x006ae5b2
                                                                                          0x006ae5fa
                                                                                          0x006ae5fb
                                                                                          0x006ae5fb
                                                                                          0x00000000
                                                                                          0x006ae59a

                                                                                          APIs
                                                                                          • SendNotifyMessageW.USER32(00140394,00000496,00002711,-00000001), ref: 006AE618
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageNotifySend
                                                                                          • String ID: (\m$MS PGothic
                                                                                          • API String ID: 3556456075-219475269
                                                                                          • Opcode ID: 83729d4cf75c2fd258fce64a3f74e09f5c2acd3961ec6e5483b5bbfa5750e511
                                                                                          • Instruction ID: c4b29eded5dd607060819086577383edb80d612be209ecb45f272f1b38c29540
                                                                                          • Opcode Fuzzy Hash: 83729d4cf75c2fd258fce64a3f74e09f5c2acd3961ec6e5483b5bbfa5750e511
                                                                                          • Instruction Fuzzy Hash: 295150347011448BC700FF69D88AE5A77E3EB9A308B54557AF4049F366CA7AEC42CF99
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060D530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 73%
                                                                                          			E0060D530(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char* _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				int _t30;
				intOrPtr _t63;
				void* _t71;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;

				_t71 = __edi;
				_t54 = __ebx;
				_t75 = _t76;
				_t55 = 4;
				do {
					_push(0);
					_push(0);
					_t55 = _t55 - 1;
				} while (_t55 != 0);
				_push(_t55);
				_push(__ebx);
				_t73 = __eax;
				_t78 = 0;
				_push(_t75);
				_push(0x60d629);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				while(1) {
					E005C75E4( &_v12, _t54, _t55, _t78); // executed
					_t55 = L".tmp";
					E0060D294(0, _t54, L".tmp", _v12, _t71, _t73,  &_v8); // executed
					_t30 = CreateDirectoryW(E0040B278(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t54 = GetLastError();
					_t78 = _t54 - 0xb7;
					if(_t54 != 0xb7) {
						E005CD508(0x3d,  &_v32, _v8);
						_v28 = _v32;
						E0042302C( &_v36, _t54, 0);
						_v24 = _v36;
						E005C857C(_t54,  &_v40);
						_v20 = _v40;
						E005CD4D8(0x81, 2,  &_v28,  &_v16);
						_t55 = _v16;
						E00429008(_v16, 1);
						E004098C4();
					}
				}
				E0040A5A8(_t73, _v8);
				__eflags = 0;
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E0060D630);
				E0040A228( &_v40, 3);
				return E0040A228( &_v16, 3);
			}


















                                                                                          0x0060d530
                                                                                          0x0060d530
                                                                                          0x0060d531
                                                                                          0x0060d533
                                                                                          0x0060d538
                                                                                          0x0060d538
                                                                                          0x0060d53a
                                                                                          0x0060d53c
                                                                                          0x0060d53c
                                                                                          0x0060d53f
                                                                                          0x0060d540
                                                                                          0x0060d542
                                                                                          0x0060d544
                                                                                          0x0060d546
                                                                                          0x0060d547
                                                                                          0x0060d54c
                                                                                          0x0060d54f
                                                                                          0x0060d552
                                                                                          0x0060d559
                                                                                          0x0060d561
                                                                                          0x0060d568
                                                                                          0x0060d578
                                                                                          0x0060d57f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0060d586
                                                                                          0x0060d588
                                                                                          0x0060d58e
                                                                                          0x0060d59e
                                                                                          0x0060d5a6
                                                                                          0x0060d5b2
                                                                                          0x0060d5ba
                                                                                          0x0060d5c2
                                                                                          0x0060d5ca
                                                                                          0x0060d5d9
                                                                                          0x0060d5de
                                                                                          0x0060d5e8
                                                                                          0x0060d5ed
                                                                                          0x0060d5ed
                                                                                          0x0060d58e
                                                                                          0x0060d5fc
                                                                                          0x0060d601
                                                                                          0x0060d603
                                                                                          0x0060d606
                                                                                          0x0060d609
                                                                                          0x0060d616
                                                                                          0x0060d628

                                                                                          APIs
                                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,0060D629,?,006D579C,?,00000003,00000000,00000000,?,006AC8F3,00000000,006ACA22), ref: 0060D578
                                                                                          • GetLastError.KERNEL32(00000000,00000000,?,00000000,0060D629,?,006D579C,?,00000003,00000000,00000000,?,006AC8F3,00000000,006ACA22), ref: 0060D581
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: .tmp
                                                                                          • API String ID: 1375471231-2986845003
                                                                                          • Opcode ID: 745e825967bed1ed56598071db3acbcf2ecf1c123272c957dfaa8018e608a5af
                                                                                          • Instruction ID: 90e89e80a8d15c693f6baa1c53929b57ef88e13b94ce627ec608a80cc6a9e7e5
                                                                                          • Opcode Fuzzy Hash: 745e825967bed1ed56598071db3acbcf2ecf1c123272c957dfaa8018e608a5af
                                                                                          • Instruction Fuzzy Hash: F4219975A502089FDB05EBE4CC51EEEB7B9EB88304F10457AF901F3381DA75AE058B64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E006AC180() {
				void* _v8;
				void* __ecx;
				void* _t9;
				long _t15;
				void* _t16;

				if( *0x6d67dd == 0) {
					_t16 = 0;
				} else {
					_t16 = 2;
				}
				_t9 = E005C7A14(_t16,  *((intOrPtr*)(0x6cd7ec + ( *0x6d67dc & 0x000000ff) * 4)), 0x80000002,  &_v8, 1, 0); // executed
				if(_t9 == 0) {
					E005C793C();
					E005C793C();
					_t15 = RegCloseKey(_v8); // executed
					return _t15;
				}
				return _t9;
			}








                                                                                          0x006ac18c
                                                                                          0x006ac192
                                                                                          0x006ac18e
                                                                                          0x006ac18e
                                                                                          0x006ac18e
                                                                                          0x006ac1b1
                                                                                          0x006ac1b8
                                                                                          0x006ac1c7
                                                                                          0x006ac1d9
                                                                                          0x006ac1e2
                                                                                          0x00000000
                                                                                          0x006ac1e2
                                                                                          0x006ac1ea

                                                                                          APIs
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,006AC56B,00000000,006AC586,?,00000000,00000000,?,006B7B68,00000006), ref: 006AC1E2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close
                                                                                          • String ID: RegisteredOrganization$RegisteredOwner
                                                                                          • API String ID: 3535843008-1113070880
                                                                                          • Opcode ID: bd898d473dd1f21ff1d6f1f73f3955f0af61235c1559c7df92e3e59f0577a32c
                                                                                          • Instruction ID: ca4fc0b31771868649da923643cba903dbb3fbd6f1f7080981924f9495942079
                                                                                          • Opcode Fuzzy Hash: bd898d473dd1f21ff1d6f1f73f3955f0af61235c1559c7df92e3e59f0577a32c
                                                                                          • Instruction Fuzzy Hash: E8F09030744108AFE700EAD4DC56BAA7B9FE787714F60106AF1008BB82C630AE00CF54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0045DCD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 65%
                                                                                          			E0045DCD4(void* __eax, struct HINSTANCE__* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				intOrPtr _t15;
				struct HINSTANCE__* _t20;
				intOrPtr* _t22;
				intOrPtr _t30;
				void* _t32;
				intOrPtr* _t35;
				intOrPtr _t38;
				intOrPtr _t40;

				_t38 = _t40;
				_push(_t22);
				_t35 = _t22;
				_t20 = __edx;
				_t32 = __eax;
				if(__edx == 0) {
					_t20 =  *0x6d2634; // 0x400000
				}
				_t10 = FindResourceW(_t20, E0040B278(_t32), 0xa) & 0xffffff00 | _t9 != 0x00000000;
				_t43 = _t10;
				if(_t10 == 0) {
					return _t10;
				} else {
					_v8 = E0046A120(_t20, 1, 0xa, _t32);
					_push(_t38);
					_push(0x45dd48);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_t15 = E0046970C(_v8, _t20,  *_t35, _t32, _t35, _t43); // executed
					 *_t35 = _t15;
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(E0045DD4F);
					return E00408444(_v8);
				}
			}


















                                                                                          0x0045dcd5
                                                                                          0x0045dcd7
                                                                                          0x0045dcdb
                                                                                          0x0045dcdd
                                                                                          0x0045dcdf
                                                                                          0x0045dce3
                                                                                          0x0045dce5
                                                                                          0x0045dce5
                                                                                          0x0045dcfd
                                                                                          0x0045dd00
                                                                                          0x0045dd02
                                                                                          0x0045dd56
                                                                                          0x0045dd04
                                                                                          0x0045dd15
                                                                                          0x0045dd1a
                                                                                          0x0045dd1b
                                                                                          0x0045dd20
                                                                                          0x0045dd23
                                                                                          0x0045dd2b
                                                                                          0x0045dd30
                                                                                          0x0045dd34
                                                                                          0x0045dd37
                                                                                          0x0045dd3a
                                                                                          0x0045dd47
                                                                                          0x0045dd47

                                                                                          APIs
                                                                                          • FindResourceW.KERNEL32(00000000,00000000,0000000A,?,?,00000000,00000000,?,00464898,00000000,004648B0,?,0000FFA2,00000000,00000000), ref: 0045DCF6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FindResource
                                                                                          • String ID: PJD
                                                                                          • API String ID: 1635176832-3906655652
                                                                                          • Opcode ID: fb906de5b7df096174a51870c3616e0680dbb0658eaa76db15ccba6fc9cffe2a
                                                                                          • Instruction ID: 9e9cb69db72ad1d60b1701949aaf6aea8306ac3adf786de72eece40cda775536
                                                                                          • Opcode Fuzzy Hash: fb906de5b7df096174a51870c3616e0680dbb0658eaa76db15ccba6fc9cffe2a
                                                                                          • Instruction Fuzzy Hash: 9601F771700300ABD711DF66EC9292AB7ADEB85715B11007EF90097251EA79DC059668
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00414DA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00414DA0(long __eax, WCHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				WCHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				WCHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00407404();
				_t24 = CreateWindowExW(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E004073F4(_t13);
				return _t24;
			}








                                                                                          0x00414da7
                                                                                          0x00414dac
                                                                                          0x00414dae
                                                                                          0x00414ddf
                                                                                          0x00414de8
                                                                                          0x00414df4

                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID: TWindowDisabler-Window
                                                                                          • API String ID: 716092398-1824977358
                                                                                          • Opcode ID: b8b775b51f73ca30bac71de3a5aa2dd226752c973776daaf732847dd1bb66243
                                                                                          • Instruction ID: a9fb6cbc93b7d8fca137cee03195aa1e05eb631c50c99d8148995e53eb0ae486
                                                                                          • Opcode Fuzzy Hash: b8b775b51f73ca30bac71de3a5aa2dd226752c973776daaf732847dd1bb66243
                                                                                          • Instruction Fuzzy Hash: 7BF092B2604158BF9B80DE9DDC81EDB77ECEB4D2A4B05416AFA0CE3201D634ED118BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC0D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E006AC0D0(void* __eax, void* __edx, void* __eflags) {
				void* _v8;
				void* __ecx;
				void* _t7;
				void* _t17;
				void* _t24;

				_t24 = _t17;
				_t7 = E005C7A14(__eax, L"Software\\Microsoft\\Windows\\CurrentVersion", 0x80000002,  &_v8, 1, 0); // executed
				if(_t7 != 0) {
					return E0040A1C8(_t24);
				}
				if(E005C793C() == 0) {
					E0040A1C8(_t24);
				}
				return RegCloseKey(_v8);
			}








                                                                                          0x006ac0d7
                                                                                          0x006ac0f1
                                                                                          0x006ac0f8
                                                                                          0x00000000
                                                                                          0x006ac11e
                                                                                          0x006ac108
                                                                                          0x006ac10c
                                                                                          0x006ac10c
                                                                                          0x00000000

                                                                                          APIs
                                                                                            • Part of subcall function 005C7A14: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005C80EE,?,00000000,?,005C808E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C7A30
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,006B813A,?,006AC32E,00000000,006AC586,?,00000000,00000000), ref: 006AC115
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion, xrefs: 006AC0E7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion
                                                                                          • API String ID: 47109696-1019749484
                                                                                          • Opcode ID: 9928fcfe71ca81cb6b52f00efe36f7f1192d12567af102c4f0791439c4b21638
                                                                                          • Instruction ID: 9fe961e3a0f1dd2c49f778430c2599f74e8698f8579e7211867226b13b49c2b0
                                                                                          • Opcode Fuzzy Hash: 9928fcfe71ca81cb6b52f00efe36f7f1192d12567af102c4f0791439c4b21638
                                                                                          • Instruction Fuzzy Hash: 8FF082317042186BEA04B69E6C52BAEA69D9B86764F60007EF608D7283D9A49E0107A9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C7A14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005C7A14(void* __eax, short* __ecx, void* __edx, void** _a4, int _a8, int _a12) {
				long _t7;
				short* _t8;
				void* _t9;
				int _t10;

				_t9 = __edx;
				_t8 = __ecx;
				_t10 = _a8;
				if(__eax == 2) {
					_t10 = _t10 | 0x00000100;
				}
				_t7 = RegOpenKeyExW(_t9, _t8, _a12, _t10, _a4); // executed
				return _t7;
			}







                                                                                          0x005c7a14
                                                                                          0x005c7a14
                                                                                          0x005c7a18
                                                                                          0x005c7a1d
                                                                                          0x005c7a1f
                                                                                          0x005c7a1f
                                                                                          0x005c7a30
                                                                                          0x005c7a37

                                                                                          APIs
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005C80EE,?,00000000,?,005C808E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C7A30
                                                                                          Strings
                                                                                          • Control Panel\Desktop\ResourceLocale, xrefs: 005C7A2E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open
                                                                                          • String ID: Control Panel\Desktop\ResourceLocale
                                                                                          • API String ID: 71445658-1109908249
                                                                                          • Opcode ID: 06a7132f66d0f60adfa239dc575e30208fbe0ee06a5a11f688fbfd3b74e0f472
                                                                                          • Instruction ID: f7a531ddb9cdcc56bc9141aac83b8570c2bea4ceb2af7b348951fcc1ebd06380
                                                                                          • Opcode Fuzzy Hash: 06a7132f66d0f60adfa239dc575e30208fbe0ee06a5a11f688fbfd3b74e0f472
                                                                                          • Instruction Fuzzy Hash: C3D0C97291022C7B9B009ED9DC41EFB7B9DEB19360F40845AFD0897100C2B4EDA18BF4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C77F4 Relevance: 3.1, APIs: 2, Instructions: 112registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 90%
                                                                                          			E005C77F4(void* __eax, void* __ebx, intOrPtr __ecx, short* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				short* _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				long _t46;
				signed int _t58;
				char _t66;
				intOrPtr _t82;
				void* _t87;
				signed int _t93;
				void* _t96;

				_v8 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_t87 = __eax;
				_push(_t96);
				_push(0x5c792a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t96 + 0xffffffec;
				while(1) {
					_v24 = 0;
					_t46 = RegQueryValueExW(_t87, _v12, 0,  &_v20, 0,  &_v24); // executed
					if(_t46 != 0 || _v20 != _a8 && _v20 != _a4) {
						break;
					}
					if(_v24 != 0) {
						__eflags = _v24 - 0x70000000;
						if(__eflags >= 0) {
							E00428FFC();
						}
						_t80 = _v24 + 1 >> 1;
						E0040A350( &_v8, _v24 + 1 >> 1, 0, __eflags);
						_t58 = RegQueryValueExW(_t87, _v12, 0,  &_v20, E0040A774( &_v8),  &_v24); // executed
						__eflags = _t58 - 0xea;
						if(_t58 == 0xea) {
							continue;
						} else {
							__eflags = _t58;
							if(_t58 != 0) {
								break;
							}
							__eflags = _v20 - _a8;
							if(_v20 == _a8) {
								L12:
								_t93 = _v24 >> 1;
								while(1) {
									__eflags = _t93;
									if(_t93 == 0) {
										break;
									}
									_t66 = _v8;
									__eflags =  *((short*)(_t66 + _t93 * 2 - 2));
									if( *((short*)(_t66 + _t93 * 2 - 2)) == 0) {
										_t93 = _t93 - 1;
										__eflags = _t93;
										continue;
									}
									break;
								}
								__eflags = _v20 - 7;
								if(_v20 == 7) {
									__eflags = _t93;
									if(_t93 != 0) {
										_t93 = _t93 + 1;
										__eflags = _t93;
									}
								}
								E0040B3F0( &_v8, _t80, _t93);
								__eflags = _v20 - 7;
								if(_v20 == 7) {
									__eflags = _t93;
									if(_t93 != 0) {
										(E0040A774( &_v8))[_t93 * 2 - 2] = 0;
									}
								}
								E0040A5A8(_v16, _v8);
								break;
							}
							__eflags = _v20 - _a4;
							if(_v20 != _a4) {
								break;
							}
							goto L12;
						}
					} else {
						E0040A1C8(_v16);
						break;
					}
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E005C7931);
				return E0040A1C8( &_v8);
			}















                                                                                          0x005c77ff
                                                                                          0x005c7802
                                                                                          0x005c7805
                                                                                          0x005c7808
                                                                                          0x005c780c
                                                                                          0x005c780d
                                                                                          0x005c7812
                                                                                          0x005c7815
                                                                                          0x005c781a
                                                                                          0x005c781c
                                                                                          0x005c7830
                                                                                          0x005c7837
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c7855
                                                                                          0x005c7866
                                                                                          0x005c786d
                                                                                          0x005c786f
                                                                                          0x005c786f
                                                                                          0x005c787d
                                                                                          0x005c7881
                                                                                          0x005c789e
                                                                                          0x005c78a3
                                                                                          0x005c78a8
                                                                                          0x00000000
                                                                                          0x005c78ae
                                                                                          0x005c78ae
                                                                                          0x005c78b0
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c78b5
                                                                                          0x005c78b8
                                                                                          0x005c78c2
                                                                                          0x005c78c5
                                                                                          0x005c78ca
                                                                                          0x005c78ca
                                                                                          0x005c78cc
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c78ce
                                                                                          0x005c78d1
                                                                                          0x005c78d7
                                                                                          0x005c78c9
                                                                                          0x005c78c9
                                                                                          0x00000000
                                                                                          0x005c78c9
                                                                                          0x00000000
                                                                                          0x005c78d7
                                                                                          0x005c78d9
                                                                                          0x005c78dd
                                                                                          0x005c78df
                                                                                          0x005c78e1
                                                                                          0x005c78e3
                                                                                          0x005c78e3
                                                                                          0x005c78e3
                                                                                          0x005c78e1
                                                                                          0x005c78e9
                                                                                          0x005c78ee
                                                                                          0x005c78f2
                                                                                          0x005c78f4
                                                                                          0x005c78f6
                                                                                          0x005c7900
                                                                                          0x005c7900
                                                                                          0x005c78f6
                                                                                          0x005c790d
                                                                                          0x00000000
                                                                                          0x005c7912
                                                                                          0x005c78bd
                                                                                          0x005c78c0
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c78c0
                                                                                          0x005c7857
                                                                                          0x005c785a
                                                                                          0x00000000
                                                                                          0x005c785f
                                                                                          0x005c7855
                                                                                          0x005c7916
                                                                                          0x005c7919
                                                                                          0x005c791c
                                                                                          0x005c7929

                                                                                          APIs
                                                                                          • RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,?,00000000,005C792A,?,006AE670,00000000), ref: 005C7830
                                                                                          • RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,70000000,00000001,?,00000000,00000000,00000000,?,00000000,005C792A,?,006AE670), ref: 005C789E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID:
                                                                                          • API String ID: 3660427363-0
                                                                                          • Opcode ID: 589ae462ae87c3b6b00b957e49d0f9022839850417cfdc1bf6308ff221649d6e
                                                                                          • Instruction ID: 9b528eccc0d206dd4e001c403f359889162c2cb04d4ae21286424304afe4548d
                                                                                          • Opcode Fuzzy Hash: 589ae462ae87c3b6b00b957e49d0f9022839850417cfdc1bf6308ff221649d6e
                                                                                          • Instruction Fuzzy Hash: 0D414731A0421DAFDB10DBD5C985EAEBBB8FB08700F50486AE915B7690D734AE04CBA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005D0A74 Relevance: 3.1, APIs: 2, Instructions: 107COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 78%
                                                                                          			E005D0A74(intOrPtr* __eax, void* __eflags, void* __fp0) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				void* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t68;
				int _t72;
				intOrPtr _t88;
				void* _t89;
				intOrPtr _t94;
				void* _t102;
				intOrPtr _t103;
				intOrPtr _t111;
				void* _t113;
				int _t114;
				void* _t116;
				void* _t121;
				void* _t123;
				intOrPtr _t124;
				void* _t126;

				_t126 = __eflags;
				_t121 = _t123;
				_t124 = _t123 + 0xffffffe8;
				_push(_t89);
				_push(_t116);
				_push(_t113);
				_v8 = __eax;
				_t94 =  *0x6cdb9c; // 0x6d66b8
				_t2 = _t94 + 0x2c; // 0x8
				_t103 =  *0x6cdb9c; // 0x6d66b8
				_t3 = _t103 + 8; // 0x24daeac
				E005CE198( *((intOrPtr*)(_v8 + 0x74)), _t89,  *_t2,  *_t3, _t113, _t116, __fp0, 8, 0); // executed
				E005CE26C( *((intOrPtr*)(_v8 + 0x74)), _t89, _v8 + 0x3d4, _v8 + 0x3d0, _t113, _t116, _t126); // executed
				if( *(_v8 + 0x3d0) != 6) {
					L2:
					_v12 = E005D10C4(0, 1, _t113);
					 *[fs:eax] = _t124;
					E005D0564(_v8, _v12);
					E005CE3FC(_v8, 6,  *(_v8 + 0x3d0), _t128, 0xd,  *(_v8 + 0x3d4));
					 *((intOrPtr*)( *_v8 + 0x70))( *[fs:eax], 0x5d0bae, _t121);
					_t114 = _v20;
					_t68 = MulDiv(_t114,  *(_v8 + 0x3d0), 6);
					_t72 = MulDiv(_v16,  *(_v8 + 0x3d4), 0xd);
					E005AE564(_v8);
					 *((intOrPtr*)( *_v8 + 0xc8))(E005AE584(_v8), _t72 +  *((intOrPtr*)(_v8 + 0x5c)) - _v16, _t68 +  *((intOrPtr*)(_v8 + 0x58)) - _t114);
					_pop(_t111);
					_pop(_t102);
					 *[fs:eax] = _t111;
					_push(E005D0BB5);
					return E005D05DC( *_v8, _t102, _v12, 0);
				} else {
					_t88 = _v8;
					_t128 =  *((intOrPtr*)(_t88 + 0x3d4)) - 0xd;
					if( *((intOrPtr*)(_t88 + 0x3d4)) == 0xd) {
						return _t88;
					} else {
						goto L2;
					}
				}
			}



























                                                                                          0x005d0a74
                                                                                          0x005d0a75
                                                                                          0x005d0a77
                                                                                          0x005d0a7a
                                                                                          0x005d0a7b
                                                                                          0x005d0a7c
                                                                                          0x005d0a7d
                                                                                          0x005d0a84
                                                                                          0x005d0a8a
                                                                                          0x005d0a8d
                                                                                          0x005d0a93
                                                                                          0x005d0a9c
                                                                                          0x005d0ab9
                                                                                          0x005d0ac8
                                                                                          0x005d0ada
                                                                                          0x005d0ae8
                                                                                          0x005d0af6
                                                                                          0x005d0aff
                                                                                          0x005d0b21
                                                                                          0x005d0b2e
                                                                                          0x005d0b3d
                                                                                          0x005d0b41
                                                                                          0x005d0b58
                                                                                          0x005d0b82
                                                                                          0x005d0b8f
                                                                                          0x005d0b97
                                                                                          0x005d0b99
                                                                                          0x005d0b9a
                                                                                          0x005d0b9d
                                                                                          0x005d0bad
                                                                                          0x005d0aca
                                                                                          0x005d0aca
                                                                                          0x005d0acd
                                                                                          0x005d0ad4
                                                                                          0x005d0bbb
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005d0ad4

                                                                                          APIs
                                                                                            • Part of subcall function 005CE26C: GetDC.USER32(00000000), ref: 005CE27D
                                                                                            • Part of subcall function 005CE26C: SelectObject.GDI32(00000001,00000000), ref: 005CE29F
                                                                                            • Part of subcall function 005CE26C: GetTextExtentPointW.GDI32(00000001,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005CE2B3
                                                                                            • Part of subcall function 005CE26C: GetTextMetricsW.GDI32(00000001,?,00000000,005CE2F8,?,00000000,?,0068D5D0,00000001), ref: 005CE2D5
                                                                                            • Part of subcall function 005CE26C: ReleaseDC.USER32 ref: 005CE2F2
                                                                                          • MulDiv.KERNEL32(006B66BF,00000006,00000006), ref: 005D0B41
                                                                                          • MulDiv.KERNEL32(?,?,0000000D), ref: 005D0B58
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$ExtentMetricsObjectPointReleaseSelect
                                                                                          • String ID:
                                                                                          • API String ID: 844173074-0
                                                                                          • Opcode ID: 56f948a4803d8bda42e55077044f91e3e5fa0501c30f1b7e22e41dab0d924d4d
                                                                                          • Instruction ID: 4b3286446c155bbe1f679e64263f80cdfde84c69ba5731eb2fff00bff0d4e1b0
                                                                                          • Opcode Fuzzy Hash: 56f948a4803d8bda42e55077044f91e3e5fa0501c30f1b7e22e41dab0d924d4d
                                                                                          • Instruction Fuzzy Hash: 8F41E735A00108EFDB00DBA8D986EADB7F9FB88704F1541A6F904EB361D771AE41DB50
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E8BC Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 72%
                                                                                          			E0040E8BC(intOrPtr __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t41;
				signed short _t43;
				signed short _t46;
				signed int _t60;
				intOrPtr _t68;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_t61 = __ecx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E0040A2AC(_v8);
				E0040A2AC(_v12);
				_push(_t84);
				_push(0x40e9d3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E0040A1C8(__ecx);
				if(_v12 == 0) {
					L14:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(E0040E9DA);
					return E0040A228( &_v28, 6);
				}
				E0040A5F0( &_v20, _v12);
				_t41 = _v12;
				if(_t41 != 0) {
					_t41 =  *(_t41 - 4);
				}
				_t60 = _t41;
				if(_t60 < 1) {
					L7:
					_t43 = E0040E5E0(_v8, _t60, _t61,  &_v16, _t81); // executed
					if(_v16 == 0) {
						L0040524C();
						E0040DF90(_t43, _t60,  &_v24, _t79, _t81);
						_t46 = E0040E70C(_v20, _t60, _t81, _v24, _t79, _t81); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x6d1c10;
							if( *0x6d1c10 == 0) {
								L00405254();
								E0040DF90(_t46, _t60,  &_v28, _t79, _t81);
								E0040E70C(_v20, _t60, _t81, _v28, _t79, _t81);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E0040E7F0(_v20, _t60, _t81, __eflags); // executed
						}
					} else {
						E0040E70C(_v20, _t60, _t81, _v16, _t79, _t81);
					}
					goto L14;
				}
				while( *((short*)(_v12 + _t60 * 2 - 2)) != 0x2e) {
					_t60 = _t60 - 1;
					__eflags = _t60;
					if(_t60 != 0) {
						continue;
					}
					goto L7;
				}
				_t61 = _t60;
				E0040B698(_v12, _t60, 1,  &_v20);
				goto L7;
			}

















                                                                                          0x0040e8bc
                                                                                          0x0040e8bc
                                                                                          0x0040e8bf
                                                                                          0x0040e8c1
                                                                                          0x0040e8c3
                                                                                          0x0040e8c5
                                                                                          0x0040e8c7
                                                                                          0x0040e8c9
                                                                                          0x0040e8cb
                                                                                          0x0040e8cc
                                                                                          0x0040e8cd
                                                                                          0x0040e8cf
                                                                                          0x0040e8d2
                                                                                          0x0040e8d8
                                                                                          0x0040e8e0
                                                                                          0x0040e8e7
                                                                                          0x0040e8e8
                                                                                          0x0040e8ed
                                                                                          0x0040e8f0
                                                                                          0x0040e8f5
                                                                                          0x0040e8fe
                                                                                          0x0040e9b8
                                                                                          0x0040e9ba
                                                                                          0x0040e9bd
                                                                                          0x0040e9c0
                                                                                          0x0040e9d2
                                                                                          0x0040e9d2
                                                                                          0x0040e90a
                                                                                          0x0040e90f
                                                                                          0x0040e914
                                                                                          0x0040e919
                                                                                          0x0040e919
                                                                                          0x0040e91b
                                                                                          0x0040e920
                                                                                          0x0040e947
                                                                                          0x0040e94d
                                                                                          0x0040e956
                                                                                          0x0040e967
                                                                                          0x0040e96f
                                                                                          0x0040e97c
                                                                                          0x0040e981
                                                                                          0x0040e984
                                                                                          0x0040e986
                                                                                          0x0040e98d
                                                                                          0x0040e98f
                                                                                          0x0040e997
                                                                                          0x0040e9a4
                                                                                          0x0040e9a4
                                                                                          0x0040e98d
                                                                                          0x0040e9a9
                                                                                          0x0040e9ac
                                                                                          0x0040e9b3
                                                                                          0x0040e9b3
                                                                                          0x0040e958
                                                                                          0x0040e960
                                                                                          0x0040e960
                                                                                          0x00000000
                                                                                          0x0040e956
                                                                                          0x0040e922
                                                                                          0x0040e942
                                                                                          0x0040e943
                                                                                          0x0040e945
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040e945
                                                                                          0x0040e931
                                                                                          0x0040e93b
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetUserDefaultUILanguage.KERNEL32(00000000,0040E9D3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EA5A,00000000,?,00000105), ref: 0040E967
                                                                                          • GetSystemDefaultUILanguage.KERNEL32(00000000,0040E9D3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EA5A,00000000,?,00000105), ref: 0040E98F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DefaultLanguage$SystemUser
                                                                                          • String ID:
                                                                                          • API String ID: 384301227-0
                                                                                          • Opcode ID: 71ff4cf4f1cef917952a99c3b56cca219de8f764a9ce9de8cf51a50ceb1d8ca6
                                                                                          • Instruction ID: f222509f0094d30d647024d0898a7a2300edb3e6cc60590d57b3240daf1099d8
                                                                                          • Opcode Fuzzy Hash: 71ff4cf4f1cef917952a99c3b56cca219de8f764a9ce9de8cf51a50ceb1d8ca6
                                                                                          • Instruction Fuzzy Hash: F1312170A002199FDB10EB9AC881BAEB7B5EF44308F50497BE400B73D1D7789D558B59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00414020 Relevance: 3.1, APIs: 2, Instructions: 57libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 65%
                                                                                          			E00414020(void* __ebx, void* __esi, struct HINSTANCE__* _a4, CHAR* _a8) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _t22;
				CHAR* _t31;
				intOrPtr _t38;
				intOrPtr _t39;
				struct HINSTANCE__* _t41;
				void* _t43;
				void* _t44;
				intOrPtr _t45;

				_t43 = _t44;
				_t45 = _t44 + 0xfffffff8;
				_v8 = 0;
				_t31 = _a8;
				_t41 = _a4;
				_push(_t43);
				_push(0x4140be);
				_push( *[fs:eax]);
				 *[fs:eax] = _t45;
				if(_t31 >> 0x10 != 0) {
					_push(_t43);
					 *[fs:eax] = _t45;
					E0040A1EC( &_v8);
					E0040A944( &_v8, 0, _t31,  *[fs:eax]);
					_t22 = GetProcAddress(_t41, E0040AC70(_v8)); // executed
					_v12 = _t22;
					_t38 = 0x4140a1;
					 *[fs:eax] = _t38;
					_push(E004140A8);
					return E0040A1EC( &_v8);
				} else {
					_v12 = GetProcAddress(_t41, _t31);
					_pop(_t39);
					 *[fs:eax] = _t39;
					_push(E004140C5);
					return E0040A1EC( &_v8);
				}
			}













                                                                                          0x00414021
                                                                                          0x00414023
                                                                                          0x0041402a
                                                                                          0x0041402d
                                                                                          0x00414030
                                                                                          0x00414035
                                                                                          0x00414036
                                                                                          0x0041403b
                                                                                          0x0041403e
                                                                                          0x00414046
                                                                                          0x00414056
                                                                                          0x0041405f
                                                                                          0x00414065
                                                                                          0x00414074
                                                                                          0x00414083
                                                                                          0x00414088
                                                                                          0x0041408d
                                                                                          0x00414090
                                                                                          0x00414093
                                                                                          0x004140a0
                                                                                          0x00414048
                                                                                          0x0041404f
                                                                                          0x004140aa
                                                                                          0x004140ad
                                                                                          0x004140b0
                                                                                          0x004140bd
                                                                                          0x004140bd

                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          • GetProcAddress.KERNEL32(?,00000000), ref: 00414083
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc
                                                                                          • String ID:
                                                                                          • API String ID: 190572456-0
                                                                                          • Opcode ID: d45503519be0c26354633d729928bcdac2510b746222e1294599c4727146ea84
                                                                                          • Instruction ID: b41df1fa75d381eed13266955d9feb05bf3a80cdd3b44aa66b38c7297c5ee5d6
                                                                                          • Opcode Fuzzy Hash: d45503519be0c26354633d729928bcdac2510b746222e1294599c4727146ea84
                                                                                          • Instruction Fuzzy Hash: 3C11C631604208AFD701DF22CC529AD7BECEB8E714BA2047AF904E3680DB385F549599
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E9E0 Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E0040E9E0(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x40ea9a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E0040B2DC( &_v536, _t49);
				_push(_v536);
				E0040B318( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E0040E8BC(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E0040B278(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0040EAA1);
				E0040A228( &_v540, 2);
				return E0040A1C8( &_v8);
			}











                                                                                          0x0040e9ed
                                                                                          0x0040e9f3
                                                                                          0x0040e9f9
                                                                                          0x0040e9fc
                                                                                          0x0040ea00
                                                                                          0x0040ea01
                                                                                          0x0040ea06
                                                                                          0x0040ea09
                                                                                          0x0040ea1c
                                                                                          0x0040ea29
                                                                                          0x0040ea34
                                                                                          0x0040ea46
                                                                                          0x0040ea54
                                                                                          0x0040ea55
                                                                                          0x0040ea5e
                                                                                          0x0040ea6d
                                                                                          0x0040ea72
                                                                                          0x0040ea76
                                                                                          0x0040ea79
                                                                                          0x0040ea7c
                                                                                          0x0040ea8c
                                                                                          0x0040ea99

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EA9A,?,00400000,006C5C30), ref: 0040EA1C
                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EA9A,?,00400000,006C5C30), ref: 0040EA6D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileLibraryLoadModuleName
                                                                                          • String ID:
                                                                                          • API String ID: 1159719554-0
                                                                                          • Opcode ID: dedb0f9fdc315c5b95161ada626066e7b9d714c18f1d320b4db995e6e324b5e8
                                                                                          • Instruction ID: bfcf378974dcce41ca09e2914a43810c414f47049a433e9fa093b73340916525
                                                                                          • Opcode Fuzzy Hash: dedb0f9fdc315c5b95161ada626066e7b9d714c18f1d320b4db995e6e324b5e8
                                                                                          • Instruction Fuzzy Hash: 46114270A4021CABDB10EB61DC86BDE73B8EB18304F5145FEA508B72D1DB785E848E99
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005ABB4C Relevance: 3.0, APIs: 2, Instructions: 50threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 69%
                                                                                          			E005ABB4C(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t12;
				intOrPtr _t16;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t32;

				_t30 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_t23 =  *0x6ccbac; // 0x0
				_v12 = _t23;
				_t24 =  *0x6ccbbc; // 0x0
				_v16 = _t24;
				 *0x6ccbac = __eax;
				 *0x6ccbbc = 0;
				_push(_t30);
				_push(0x5abbf9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				 *0x6ccbb8 = 1;
				_push(_t30);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				EnumThreadWindows(GetCurrentThreadId(), 0x5abafc, 0);
				_t12 =  *0x6ccbbc; // 0x0
				_v8 = _t12;
				_pop(_t25);
				 *[fs:eax] = _t25;
				_t26 = 0x5abbbb;
				 *[fs:eax] = _t26;
				_push(E005ABC00);
				 *0x6ccbb8 = 0;
				 *0x6ccbbc = _v16;
				_t16 = _v12;
				 *0x6ccbac = _t16;
				return _t16;
			}















                                                                                          0x005abb4d
                                                                                          0x005abb4f
                                                                                          0x005abb55
                                                                                          0x005abb5b
                                                                                          0x005abb5e
                                                                                          0x005abb64
                                                                                          0x005abb67
                                                                                          0x005abb6e
                                                                                          0x005abb7a
                                                                                          0x005abb7b
                                                                                          0x005abb80
                                                                                          0x005abb83
                                                                                          0x005abb86
                                                                                          0x005abb8f
                                                                                          0x005abb95
                                                                                          0x005abb98
                                                                                          0x005abba4
                                                                                          0x005abba9
                                                                                          0x005abbae
                                                                                          0x005abbb3
                                                                                          0x005abbb6
                                                                                          0x005abbd6
                                                                                          0x005abbd9
                                                                                          0x005abbdc
                                                                                          0x005abbe1
                                                                                          0x005abbeb
                                                                                          0x005abbf0
                                                                                          0x005abbf3
                                                                                          0x005abbf8

                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 005ABB9E
                                                                                          • EnumThreadWindows.USER32(00000000,005ABAFC,00000000), ref: 005ABBA4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$CurrentEnumWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2396873506-0
                                                                                          • Opcode ID: 50b1606a0afe4943f6b819d05498a248b249cba9426d36aa2a532158776b3fde
                                                                                          • Instruction ID: ee6e8008b641080cd7585ababab2aba3c455f5a37fbde39c0718e37cfc8f8a06
                                                                                          • Opcode Fuzzy Hash: 50b1606a0afe4943f6b819d05498a248b249cba9426d36aa2a532158776b3fde
                                                                                          • Instruction Fuzzy Hash: C5112574A08744AFD711CF66DCA2D6ABFE9E74A720F1194AAE804D3791E7756C00CFA0
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042B848 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 37%
                                                                                          			E0042B848(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x42b8ba);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x42b89c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E0040B278(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0042B8A3);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}












                                                                                          0x0042b849
                                                                                          0x0042b84b
                                                                                          0x0042b84f
                                                                                          0x0042b852
                                                                                          0x0042b857
                                                                                          0x0042b85c
                                                                                          0x0042b85d
                                                                                          0x0042b862
                                                                                          0x0042b865
                                                                                          0x0042b868
                                                                                          0x0042b86d
                                                                                          0x0042b86e
                                                                                          0x0042b873
                                                                                          0x0042b876
                                                                                          0x0042b881
                                                                                          0x0042b886
                                                                                          0x0042b88b
                                                                                          0x0042b88e
                                                                                          0x0042b891
                                                                                          0x0042b896
                                                                                          0x0042b898
                                                                                          0x0042b89b

                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(00008000,00000000), ref: 0042B852
                                                                                          • LoadLibraryW.KERNEL32(00000000,00000000,0042B89C,?,00000000,0042B8BA,?,00008000,00000000), ref: 0042B881
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLibraryLoadMode
                                                                                          • String ID:
                                                                                          • API String ID: 2987862817-0
                                                                                          • Opcode ID: 541f83a121766121c0a6f3163fd7a99b6d8d9054757383a260740e4149b14d89
                                                                                          • Instruction ID: 1e325d9ebe5d0822fb749a998e89c34c252ba1fb5941e6000e67edf6569427d0
                                                                                          • Opcode Fuzzy Hash: 541f83a121766121c0a6f3163fd7a99b6d8d9054757383a260740e4149b14d89
                                                                                          • Instruction Fuzzy Hash: D6F08270614704BEDB016FB69C5286FBBECEB4AB0079349B6F814A2691E67D581086A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B8250 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005B8250(void* __eax, void* __edx, void* __eflags) {
				void* _t9;
				void* _t17;
				void* _t22;
				void* _t23;

				_t23 = __eflags;
				_t22 = __edx;
				_t17 = __eax;
				_t9 = E0040B660( *((intOrPtr*)(__eax + 0xa4)), __edx);
				if(_t23 == 0) {
					return _t9;
				}
				if( *((char*)(_t17 + 0xc4)) != 0) {
					if( *((char*)(_t17 + 0xeb)) == 0) {
						SetWindowTextW( *(_t17 + 0x188), E0040B278(__edx));
					} else {
						SetWindowTextW( *(_t17 + 0x188), 0);
					}
				}
				_t6 = _t17 + 0xa4; // 0x24cbe84
				return E0040A5A8(_t6, _t22);
			}







                                                                                          0x005b8250
                                                                                          0x005b8253
                                                                                          0x005b8255
                                                                                          0x005b825f
                                                                                          0x005b8264
                                                                                          0x005b82ac
                                                                                          0x005b82ac
                                                                                          0x005b826d
                                                                                          0x005b8276
                                                                                          0x005b8297
                                                                                          0x005b8278
                                                                                          0x005b8281
                                                                                          0x005b8281
                                                                                          0x005b8276
                                                                                          0x005b829c
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • SetWindowTextW.USER32(?,00000000), ref: 005B8281
                                                                                          • SetWindowTextW.USER32(?,00000000), ref: 005B8297
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: TextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 530164218-0
                                                                                          • Opcode ID: c345e5e89693c0d5499a52adfddb81e4a6e0d192dc2bf912449b5cde78a3d4ee
                                                                                          • Instruction ID: 06eb74493f32fc7ca45b3b7e2b46e6e7fae3055f649a2dcd14cf2a1bc93d960e
                                                                                          • Opcode Fuzzy Hash: c345e5e89693c0d5499a52adfddb81e4a6e0d192dc2bf912449b5cde78a3d4ee
                                                                                          • Instruction Fuzzy Hash: 2AF0A7743015002ADB11AA6A8885BFA678CAF86715F0801BAFE049F387CF785D41C3BA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC477 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 35%
                                                                                          			E006AC477() {
				void* _t13;
				void* _t15;
				intOrPtr _t16;
				intOrPtr _t24;
				intOrPtr _t32;
				intOrPtr _t37;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t56;
				intOrPtr _t57;

				_t13 =  *0x6d68ac(0x6cd804, 0x8000, 0, _t56 - 4); // executed
				if(_t13 != 0) {
					_t15 =  *0x6d68ac(0x6cd814, 0x8000, 0, _t56 - 4); // executed
					if(_t15 != 0) {
						if( *0x6d67dc == 0) {
							_t16 =  *0x6d6534; // 0x24f8bf4
							E005C4EA4(_t16, _t56 - 0x38);
							E0040B4C8(0x6d6564, L"COMMAND.COM",  *((intOrPtr*)(_t56 - 0x38))); // executed
						} else {
							_t24 =  *0x6d6538; // 0x2515afc
							E005C4EA4(_t24, _t56 - 0x34);
							E0040B4C8(0x6d6564, L"cmd.exe",  *((intOrPtr*)(_t56 - 0x34)));
						}
						E006AC180(); // executed
						_pop(_t48);
						 *[fs:eax] = _t48;
						_push(E006AC58D);
						return E0040A228(_t56 - 0x38, 0xd);
					} else {
						_push(_t56);
						_push(0x6ac516);
						_push( *[fs:eax]);
						 *[fs:eax] = _t57;
						E0040C8BC();
						_pop(_t53);
						 *[fs:eax] = _t53;
						_push(E006AC51D);
						_t32 =  *((intOrPtr*)(_t56 - 4));
						_push(_t32);
						L0043C214();
						return _t32;
					}
				} else {
					_push(_t56);
					_push(0x6ac4c3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t57;
					E0040C8BC();
					_pop(_t55);
					 *[fs:eax] = _t55;
					_push(E006AC4CA);
					_t37 =  *((intOrPtr*)(_t56 - 4));
					_push(_t37);
					L0043C214();
					return _t37;
				}
			}














                                                                                          0x006ac487
                                                                                          0x006ac48f
                                                                                          0x006ac4da
                                                                                          0x006ac4e2
                                                                                          0x006ac524
                                                                                          0x006ac54a
                                                                                          0x006ac54f
                                                                                          0x006ac561
                                                                                          0x006ac526
                                                                                          0x006ac529
                                                                                          0x006ac52e
                                                                                          0x006ac540
                                                                                          0x006ac540
                                                                                          0x006ac566
                                                                                          0x006ac56d
                                                                                          0x006ac570
                                                                                          0x006ac573
                                                                                          0x006ac585
                                                                                          0x006ac4e4
                                                                                          0x006ac4e6
                                                                                          0x006ac4e7
                                                                                          0x006ac4ec
                                                                                          0x006ac4ef
                                                                                          0x006ac4fa
                                                                                          0x006ac501
                                                                                          0x006ac504
                                                                                          0x006ac507
                                                                                          0x006ac50c
                                                                                          0x006ac50f
                                                                                          0x006ac510
                                                                                          0x006ac515
                                                                                          0x006ac515
                                                                                          0x006ac491
                                                                                          0x006ac493
                                                                                          0x006ac494
                                                                                          0x006ac499
                                                                                          0x006ac49c
                                                                                          0x006ac4a7
                                                                                          0x006ac4ae
                                                                                          0x006ac4b1
                                                                                          0x006ac4b4
                                                                                          0x006ac4b9
                                                                                          0x006ac4bc
                                                                                          0x006ac4bd
                                                                                          0x006ac4c2
                                                                                          0x006ac4c2

                                                                                          APIs
                                                                                          • SHGetKnownFolderPath.SHELL32(006CD804,00008000,00000000,?,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC487
                                                                                          • CoTaskMemFree.OLE32(?,006AC4CA,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC4BD
                                                                                          • SHGetKnownFolderPath.SHELL32(006CD814,00008000,00000000,?,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC4DA
                                                                                          • CoTaskMemFree.OLE32(?,006AC51D,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC510
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FolderFreeKnownPathTask
                                                                                          • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                          • API String ID: 969438705-544719455
                                                                                          • Opcode ID: 8384953cfd88f85c37ee3bb36c9ff3900296b8c279f57d69efe11ea1f24b55c1
                                                                                          • Instruction ID: 8490eda7aae5474be0b02337b94e319d82e09844d8c50d4b14fc66eb57101d9e
                                                                                          • Opcode Fuzzy Hash: 8384953cfd88f85c37ee3bb36c9ff3900296b8c279f57d69efe11ea1f24b55c1
                                                                                          • Instruction Fuzzy Hash: 32E09232744700AEE711ABA5DC62F3A77E9E74DB10B62447AF404E2690D634AD009A28
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AC4CA Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 47%
                                                                                          			E006AC4CA() {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t19;
				intOrPtr _t27;
				intOrPtr _t36;
				intOrPtr _t41;
				void* _t42;
				intOrPtr _t43;

				_t10 =  *0x6d68ac(0x6cd814, 0x8000, 0, _t42 - 4); // executed
				if(_t10 != 0) {
					if( *0x6d67dc == 0) {
						_t11 =  *0x6d6534; // 0x24f8bf4
						E005C4EA4(_t11, _t42 - 0x38);
						E0040B4C8(0x6d6564, L"COMMAND.COM",  *((intOrPtr*)(_t42 - 0x38))); // executed
					} else {
						_t19 =  *0x6d6538; // 0x2515afc
						E005C4EA4(_t19, _t42 - 0x34);
						E0040B4C8(0x6d6564, L"cmd.exe",  *((intOrPtr*)(_t42 - 0x34)));
					}
					E006AC180(); // executed
					_pop(_t36);
					 *[fs:eax] = _t36;
					_push(E006AC58D);
					return E0040A228(_t42 - 0x38, 0xd);
				} else {
					_push(_t42);
					_push(0x6ac516);
					_push( *[fs:eax]);
					 *[fs:eax] = _t43;
					E0040C8BC();
					_pop(_t41);
					 *[fs:eax] = _t41;
					_push(E006AC51D);
					_t27 =  *((intOrPtr*)(_t42 - 4));
					_push(_t27);
					L0043C214();
					return _t27;
				}
			}











                                                                                          0x006ac4da
                                                                                          0x006ac4e2
                                                                                          0x006ac524
                                                                                          0x006ac54a
                                                                                          0x006ac54f
                                                                                          0x006ac561
                                                                                          0x006ac526
                                                                                          0x006ac529
                                                                                          0x006ac52e
                                                                                          0x006ac540
                                                                                          0x006ac540
                                                                                          0x006ac566
                                                                                          0x006ac56d
                                                                                          0x006ac570
                                                                                          0x006ac573
                                                                                          0x006ac585
                                                                                          0x006ac4e4
                                                                                          0x006ac4e6
                                                                                          0x006ac4e7
                                                                                          0x006ac4ec
                                                                                          0x006ac4ef
                                                                                          0x006ac4fa
                                                                                          0x006ac501
                                                                                          0x006ac504
                                                                                          0x006ac507
                                                                                          0x006ac50c
                                                                                          0x006ac50f
                                                                                          0x006ac510
                                                                                          0x006ac515
                                                                                          0x006ac515

                                                                                          APIs
                                                                                          • SHGetKnownFolderPath.SHELL32(006CD814,00008000,00000000,?,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC4DA
                                                                                          • CoTaskMemFree.OLE32(?,006AC51D,?,00000000,00000000,?,006B7B68,00000006,?,00000000,006B813A,?,00000000,006B81F9), ref: 006AC510
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FolderFreeKnownPathTask
                                                                                          • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                          • API String ID: 969438705-544719455
                                                                                          • Opcode ID: 313031661c9f3d937668f184e05f07051bbe0573f7bc91d8efeaafa51bbcf367
                                                                                          • Instruction ID: c6c261769d38d943bb646f4c75fbe89f1fed75b0b48c3df2323ffd2a5fb60eac
                                                                                          • Opcode Fuzzy Hash: 313031661c9f3d937668f184e05f07051bbe0573f7bc91d8efeaafa51bbcf367
                                                                                          • Instruction Fuzzy Hash: 7DE02230B00300AEEB12AFA8CC02F2A73A9EB09B40F62447AF400D6680D634ED108E38
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004236FC Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,?,?,00443D4C,00469961,00000000,00469A4C,?,?,00443D4C), ref: 00423745
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: 8e2942e761046376e11b5786c2327113aab245fcf1745a1c3143851c9d9cb467
                                                                                          • Instruction ID: 502252b8251e75369e7d593655d0488969bd90bcda5cf89e16fadd6ec266699d
                                                                                          • Opcode Fuzzy Hash: 8e2942e761046376e11b5786c2327113aab245fcf1745a1c3143851c9d9cb467
                                                                                          • Instruction Fuzzy Hash: AEE0DFE3B401243AF72069AE9C82F7B9159C781776F06023AFB60EB2D1C558EC0086E8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C857C Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005C857C(long __eax, void* __edx) {
				short _v2052;
				signed int _t7;
				void* _t10;
				signed int _t16;
				void* _t17;

				_t10 = __edx;
				_t7 = FormatMessageW(0x3200, 0, __eax, 0,  &_v2052, 0x400, 0); // executed
				while(_t7 > 0) {
					_t16 =  *(_t17 + _t7 * 2 - 2) & 0x0000ffff;
					if(_t16 <= 0x20) {
						L1:
						_t7 = _t7 - 1;
						__eflags = _t7;
						continue;
					} else {
						_t20 = _t16 - 0x2e;
						if(_t16 == 0x2e) {
							goto L1;
						}
					}
					break;
				}
				return E0040A350(_t10, _t7, _t17, _t20);
			}








                                                                                          0x005c8583
                                                                                          0x005c859b
                                                                                          0x005c85a3
                                                                                          0x005c85a7
                                                                                          0x005c85b0
                                                                                          0x005c85a2
                                                                                          0x005c85a2
                                                                                          0x005c85a2
                                                                                          0x00000000
                                                                                          0x005c85b2
                                                                                          0x005c85b2
                                                                                          0x005c85b6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c85b6
                                                                                          0x00000000
                                                                                          0x005c85b0
                                                                                          0x005c85c9

                                                                                          APIs
                                                                                          • FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005CBEAE,00000000,005CBEFF,?,005CC0E0), ref: 005C859B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FormatMessage
                                                                                          • String ID:
                                                                                          • API String ID: 1306739567-0
                                                                                          • Opcode ID: 76f0293a2078b6ed324a61796bd6559e67e3fcefcb42d4882ee26b0c0a9635cc
                                                                                          • Instruction ID: 09862238c43e822cbcf5df792bab944b0a9534785c307f7411e32f5bd31f51a0
                                                                                          • Opcode Fuzzy Hash: 76f0293a2078b6ed324a61796bd6559e67e3fcefcb42d4882ee26b0c0a9635cc
                                                                                          • Instruction Fuzzy Hash: 30E020707543113EF32421950C43FFA1589F7C0B04FE4443D76409D2D5DEF9D8554296
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C6808 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 31%
                                                                                          			E005C6808(void* __eax, void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t24;

				_push(0);
				_push(_t24);
				_push(0x5c684e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t24;
				E005C567C(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesW(E0040B278(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E005C6855);
				return E0040A1C8( &_v8);
			}






                                                                                          0x005c680b
                                                                                          0x005c6812
                                                                                          0x005c6813
                                                                                          0x005c6818
                                                                                          0x005c681b
                                                                                          0x005c6823
                                                                                          0x005c6831
                                                                                          0x005c683a
                                                                                          0x005c683d
                                                                                          0x005c6840
                                                                                          0x005c684d

                                                                                          APIs
                                                                                          • GetFileAttributesW.KERNEL32(00000000,00000000,005C684E,?,00000000,00000000,?,005C689E,00000000,0060C275,00000000,0060C296,?,00000000,00000000,006B912A), ref: 005C6831
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 100aa8c885844b80d4bab272ed6ed49f781f543bc4f1b9d50669adcd56226391
                                                                                          • Instruction ID: 7ef4f7d410bb1350c6c34c2cfd3ab79e32246cebd9daa6780dadc2d4ee8c12dd
                                                                                          • Opcode Fuzzy Hash: 100aa8c885844b80d4bab272ed6ed49f781f543bc4f1b9d50669adcd56226391
                                                                                          • Instruction Fuzzy Hash: 9AE09231344308AFE701EAF6CC52E5DB7EDE749704B924879F400D7682E678AE108458
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040D754 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0040D754(void* __eax) {
				short _v532;
				void* __ebx;
				void* __esi;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t16 = __eax;
				_t22 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x400000
					GetModuleFileNameW( *_t3,  &_v532, 0x20a);
					_t14 = E0040E9E0(_t21, _t16, _t18, _t19, _t22); // executed
					_t20 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t20;
					if(_t20 == 0) {
						_t5 = _t16 + 4; // 0x400000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x400000
				return  *_t7;
			}












                                                                                          0x0040d75c
                                                                                          0x0040d75e
                                                                                          0x0040d762
                                                                                          0x0040d76e
                                                                                          0x0040d772
                                                                                          0x0040d77b
                                                                                          0x0040d780
                                                                                          0x0040d782
                                                                                          0x0040d787
                                                                                          0x0040d789
                                                                                          0x0040d78c
                                                                                          0x0040d78c
                                                                                          0x0040d787
                                                                                          0x0040d78f
                                                                                          0x0040d79a

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040D772
                                                                                            • Part of subcall function 0040E9E0: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EA9A,?,00400000,006C5C30), ref: 0040EA1C
                                                                                            • Part of subcall function 0040E9E0: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EA9A,?,00400000,006C5C30), ref: 0040EA6D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleName$LibraryLoad
                                                                                          • String ID:
                                                                                          • API String ID: 4113206344-0
                                                                                          • Opcode ID: 0c4338d5c56e5e7d061b7f443bbaa86d882c427cb1541d3f25e0c99049ab022e
                                                                                          • Instruction ID: e6e9750417710ce6057aade1326652b07051d0f0da16d230474427610a1a2044
                                                                                          • Opcode Fuzzy Hash: 0c4338d5c56e5e7d061b7f443bbaa86d882c427cb1541d3f25e0c99049ab022e
                                                                                          • Instruction Fuzzy Hash: 6EE0C9B1A013109BCB10DE98C8C5A577794AF08754F044AA6ED64DF386D375D9248BD5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005118B8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E005118B8(intOrPtr* __eax, void* __edx) {
				void* _t15;
				intOrPtr _t16;
				intOrPtr* _t17;

				_t17 = __eax;
				_t1 = _t17 + 0x5c; // 0x27365
				_push( *_t1);
				_t15 =  *((intOrPtr*)( *__eax + 0xc8))();
				 *(__eax + 0x98) =  *(__eax + 0x98) | 0x00000004;
				if(( *(__eax + 0x1c) & 0x00000002) != 0) {
					_t10 = _t17 + 0x58; // 0x756c6156
					_t16 =  *_t10;
					 *((intOrPtr*)(__eax + 0x1b8)) = _t16;
					return _t16;
				}
				return _t15;
			}






                                                                                          0x005118ba
                                                                                          0x005118bd
                                                                                          0x005118c0
                                                                                          0x005118cb
                                                                                          0x005118d1
                                                                                          0x005118dc
                                                                                          0x005118de
                                                                                          0x005118de
                                                                                          0x005118e1
                                                                                          0x00000000
                                                                                          0x005118e1
                                                                                          0x005118e9

                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(00027365,00000000,00000000,004C0068,006083EC,?,00000000,?,00000001,00000000,00000000,00000000,?,0068D5D0,00000001), ref: 005118CB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallbackDispatcherUser
                                                                                          • String ID:
                                                                                          • API String ID: 2492992576-0
                                                                                          • Opcode ID: 1ef83a670f5add13b9a374239f5fba316326babbb4ed16e1d195e7c525f61efe
                                                                                          • Instruction ID: 9fcb5f38b0df23c263da8a60913ea9fccafb23266d8756c351c2c96681b23a4d
                                                                                          • Opcode Fuzzy Hash: 1ef83a670f5add13b9a374239f5fba316326babbb4ed16e1d195e7c525f61efe
                                                                                          • Instruction Fuzzy Hash: 70E09A712056405BEB84DE5CC4C5B957BE9AF49214F1440E5ED498B25BC7749C48CB54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C685C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005C685C(void* __eax) {
				signed char _t5;

				_t5 = GetFileAttributesW(E0040B278(__eax)); // executed
				if(_t5 == 0xffffffff || (_t5 & 0x00000010) != 0) {
					return 0;
				} else {
					return 1;
				}
			}




                                                                                          0x005c6867
                                                                                          0x005c686f
                                                                                          0x005c6878
                                                                                          0x005c6879
                                                                                          0x005c687c
                                                                                          0x005c687c

                                                                                          APIs
                                                                                          • GetFileAttributesW.KERNEL32(00000000,00000000,005CD6D7,00000000), ref: 005C6867
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 7f8396d0fa91f7505231e2c5336139b243cbcf2205d43ca2743d5f1455852090
                                                                                          • Instruction ID: 78aee2f50b20cc69f9a983c300c852fe0a8819bfcc82724499c751dbdfa7c08b
                                                                                          • Opcode Fuzzy Hash: 7f8396d0fa91f7505231e2c5336139b243cbcf2205d43ca2743d5f1455852090
                                                                                          • Instruction Fuzzy Hash: 86C08CA02412000A6E1065FE1CC9E5902E85E0533A3240B6EF438E22E3D629CAA3201A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00424020 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E00424020(void* __eax) {
				int _t4;

				_t4 = SetCurrentDirectoryW(E0040B278(__eax)); // executed
				asm("sbb eax, eax");
				return _t4 + 1;
			}




                                                                                          0x0042402b
                                                                                          0x00424033
                                                                                          0x00424037

                                                                                          APIs
                                                                                          • SetCurrentDirectoryW.KERNEL32(00000000,?,006B8A06,00000000,006B8C15,?,?,00000005,00000000,006B8C4E,?,?,00000000), ref: 0042402B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentDirectory
                                                                                          • String ID:
                                                                                          • API String ID: 1611563598-0
                                                                                          • Opcode ID: abdc5c14bdf0f568318fd376890c62b4e1504ecd4b2cbc0fc59dba2eed968519
                                                                                          • Instruction ID: daf6799c843f8394e9bb8cef5a1a486137c4a768e82a56cfe4f83ef7845b6ded
                                                                                          • Opcode Fuzzy Hash: abdc5c14bdf0f568318fd376890c62b4e1504ecd4b2cbc0fc59dba2eed968519
                                                                                          • Instruction Fuzzy Hash: 9AB012A27903400ACE0075FF0CC9D1D00CCD95920F7200FBFB409D2143D57EC484001C
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042B8A3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 50%
                                                                                          			E0042B8A3() {
				int _t4;
				intOrPtr _t7;
				void* _t8;

				_pop(_t7);
				 *[fs:eax] = _t7;
				_push(0x42b8c1);
				_t4 = SetErrorMode( *(_t8 - 0xc)); // executed
				return _t4;
			}






                                                                                          0x0042b8a5
                                                                                          0x0042b8a8
                                                                                          0x0042b8ab
                                                                                          0x0042b8b4
                                                                                          0x0042b8b9

                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(?,0042B8C1), ref: 0042B8B4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode
                                                                                          • String ID:
                                                                                          • API String ID: 2340568224-0
                                                                                          • Opcode ID: f668b7aac12c857ffb67314c22418dc82c6b08374c4fda6f72eaba5712bdb9bb
                                                                                          • Instruction ID: 1e160e63f6e1d4a3e736ac7d2d169814141797cfe1ada65cb98a64290c0f9c9c
                                                                                          • Opcode Fuzzy Hash: f668b7aac12c857ffb67314c22418dc82c6b08374c4fda6f72eaba5712bdb9bb
                                                                                          • Instruction Fuzzy Hash: 9CB09B76F0C2005DA709B695745146C67D8EBC47103E148A7F404C2540D57C5444451C
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0047845C Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0047845C(intOrPtr _a4, intOrPtr _a8) {
				void* __ebx;
				void* _t14;
				void _t15;
				void* _t24;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0x6d4ff8 == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0x6d4ff4; // 0x900000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E0040714C(0x6c7a94, _t24, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E00478454(_t2, 0x478434);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E00478454(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0x6d4ff8;
						 *0x6d4ff8 = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0x6d4ff4 = _t35;
				}
				_t25 =  *0x6d4ff8;
				 *0x6d4ff8 =  *((intOrPtr*)(_t25 + 5));
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0x6d4ff8;
			}










                                                                                          0x0047846a
                                                                                          0x0047847a
                                                                                          0x0047847f
                                                                                          0x00478481
                                                                                          0x00478486
                                                                                          0x00478488
                                                                                          0x00478495
                                                                                          0x0047849f
                                                                                          0x004784a7
                                                                                          0x004784aa
                                                                                          0x004784aa
                                                                                          0x004784ad
                                                                                          0x004784ad
                                                                                          0x004784b0
                                                                                          0x004784ba
                                                                                          0x004784bf
                                                                                          0x004784c2
                                                                                          0x004784c4
                                                                                          0x004784cb
                                                                                          0x004784d2
                                                                                          0x004784d2
                                                                                          0x004784da
                                                                                          0x004784df
                                                                                          0x004784e4
                                                                                          0x004784ea
                                                                                          0x004784f1

                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,0068D5D0,?,?,0051557F,00517B00,?,0068D5D0,?,00000000,?,005ACC13), ref: 0047847A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: 24da2cb6f067e190634611219f444f96da0d604869c53dd669d1a3600f419ae9
                                                                                          • Instruction ID: 21ed9f25b44590dd6a88678dd2699128a8c8abd14296acda62ee9fdc78064473
                                                                                          • Opcode Fuzzy Hash: 24da2cb6f067e190634611219f444f96da0d604869c53dd669d1a3600f419ae9
                                                                                          • Instruction Fuzzy Hash: F6114C746813069BC710DF19C880B86B7E5EB98350F10C53AE96C9F385E7B4E904CBA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004056E8 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004056E8(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void** _t10;
				void* _t12;
				void* _t14;

				_t8 = __eax;
				E0040567C(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x6cfaf4 = 0;
					return 0;
				} else {
					_t10 =  *0x6cfae0; // 0x2e10000
					_t14 = _t4;
					 *_t14 = 0x6cfadc;
					 *0x6cfae0 = _t4;
					 *(_t14 + 4) = _t10;
					 *_t10 = _t4;
					_t12 = _t14 + 0x13fff0;
					 *((intOrPtr*)(_t12 - 4)) = 2;
					 *0x6cfaf4 = 0x13ffe0 - _t8;
					_t7 = _t12 - _t8;
					 *0x6cfaf0 = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}









                                                                                          0x004056ea
                                                                                          0x004056ec
                                                                                          0x004056ff
                                                                                          0x00405706
                                                                                          0x00405758
                                                                                          0x00405761
                                                                                          0x00405708
                                                                                          0x00405708
                                                                                          0x0040570e
                                                                                          0x00405710
                                                                                          0x00405716
                                                                                          0x0040571b
                                                                                          0x0040571e
                                                                                          0x00405722
                                                                                          0x0040572d
                                                                                          0x0040573a
                                                                                          0x00405742
                                                                                          0x00405744
                                                                                          0x00405751
                                                                                          0x00405755
                                                                                          0x00405755

                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,-00000004,000000BF,00405CFF,0000001B,004062A4,024E8810,00408D1E,004090BF,?,00000000,024E8810,00408D8D), ref: 004056FF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: a522bf9bd685f9285ef17df139ca3c83d4d9edda6c804f015ead83d427766566
                                                                                          • Instruction ID: 671f966e8e8ef53a1d331dc007cdee3d18c8d913abcb1f2bfacacf6af6d793b4
                                                                                          • Opcode Fuzzy Hash: a522bf9bd685f9285ef17df139ca3c83d4d9edda6c804f015ead83d427766566
                                                                                          • Instruction Fuzzy Hash: 9CF0AFF2B003018FD7549FB89D40B12BBD6E708354F20413EE90DEB794D7B088008B88
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Function 00625754 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187pipeprocessfileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 82%
                                                                                          			E00625754(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v12;
				char _v16;
				void* _v20;
				void* _v24;
				long _v28;
				struct _STARTUPINFOW _v96;
				struct _PROCESS_INFORMATION _v112;
				char _v116;
				long _v120;
				char _v124;
				long _v128;
				char _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				void* _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char* _t62;
				WCHAR* _t91;
				WCHAR* _t97;
				intOrPtr _t98;
				void* _t127;
				intOrPtr _t139;
				struct _FILETIME* _t141;
				void* _t145;
				void* _t146;
				intOrPtr _t147;

				_t145 = _t146;
				_t147 = _t146 + 0xffffff4c;
				_v156 = 0;
				_v160 = 0;
				_v16 = 0;
				_t127 = __eax;
				_t141 =  &_v12;
				_push(_t145);
				_push(0x625a4f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t147;
				E00616130(L"Starting 64-bit helper process.", __eax, _t141, 0x6d636c);
				_t62 =  *0x6cda20; // 0x6d67dd
				if( *_t62 == 0) {
					E0060CD28(L"Cannot utilize 64-bit features on this version of Windows", _t127);
				}
				if( *0x6d6368 == 0) {
					E0060CD28(L"64-bit helper EXE wasn\'t extracted", _t127);
				}
				while(1) {
					 *0x6d636c =  *0x6d636c + 1;
					 *((intOrPtr*)(_t127 + 0x14)) = GetTickCount();
					if(QueryPerformanceCounter(_t141) == 0) {
						GetSystemTimeAsFileTime(_t141);
					}
					_v152 = GetCurrentProcessId();
					_v148 = 0;
					_v144 =  *0x6d636c;
					_v140 = 0;
					_v136 =  *((intOrPtr*)(_t127 + 0x14));
					_v132 = 0;
					_v128 = _t141->dwHighDateTime;
					_v124 = 0;
					_v120 = _t141->dwLowDateTime;
					_v116 = 0;
					E004244F8(L"\\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x", 4,  &_v152,  &_v16);
					_v20 = CreateNamedPipeW(E0040B278(_v16), 0x40080003, 6, 1, 0x2000, 0x2000, 0, 0);
					if(_v20 != 0xffffffff) {
						break;
					}
					if(GetLastError() != 0xe7) {
						E0060CE84(L"CreateNamedPipe");
					}
				}
				_push(_t145);
				_push(0x625a0b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t147;
				_v24 = CreateFileW(E0040B278(_v16), 0xc0000000, 0, 0x6cd098, 3, 0, 0);
				if(_v24 == 0xffffffff) {
					E0060CE84(L"CreateFile");
				}
				_push(_t145);
				_push(0x6259fa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t147;
				_v28 = 2;
				if(SetNamedPipeHandleState(_v24,  &_v28, 0, 0) == 0) {
					E0060CE84(L"SetNamedPipeHandleState");
				}
				E00407760( &_v96, 0x44);
				_v96.cb = 0x44;
				E005C745C( &_v156);
				_t91 = E0040B278(_v156);
				_v176 = 0x69;
				_v172 = 0;
				_v168 = _v24;
				_v164 = 0;
				E004244F8(L"helper %d 0x%x", 1,  &_v176,  &_v160);
				_t97 = E0040B278(_v160);
				_t98 =  *0x6d6368; // 0x245b374
				if(CreateProcessW(E0040B278(_t98), _t97, 0, 0, 0xffffffff, 0xc000000, 0, _t91,  &_v96,  &_v112) == 0) {
					E0060CE84(L"CreateProcess");
				}
				 *((char*)(_t127 + 4)) = 1;
				 *((char*)(_t127 + 5)) = 0;
				 *(_t127 + 8) = _v112.hProcess;
				 *((intOrPtr*)(_t127 + 0x10)) = _v112.dwProcessId;
				 *((intOrPtr*)(_t127 + 0xc)) = _v20;
				_v20 = 0;
				CloseHandle(_v112.hThread);
				_v184 =  *((intOrPtr*)(_t127 + 0x10));
				_v180 = 0;
				E006163B4(L"Helper process PID: %u", _t127, 0,  &_v184, _t141, 0x6d636c);
				_pop(_t139);
				 *[fs:eax] = _t139;
				_push(E00625A01);
				return CloseHandle(_v24);
			}






































                                                                                          0x00625755
                                                                                          0x00625757
                                                                                          0x00625762
                                                                                          0x00625768
                                                                                          0x0062576e
                                                                                          0x00625771
                                                                                          0x00625778
                                                                                          0x0062577d
                                                                                          0x0062577e
                                                                                          0x00625783
                                                                                          0x00625786
                                                                                          0x0062578e
                                                                                          0x00625793
                                                                                          0x0062579b
                                                                                          0x006257a2
                                                                                          0x006257a2
                                                                                          0x006257ae
                                                                                          0x006257b5
                                                                                          0x006257b5
                                                                                          0x006257ba
                                                                                          0x006257ba
                                                                                          0x006257c1
                                                                                          0x006257cc
                                                                                          0x006257cf
                                                                                          0x006257cf
                                                                                          0x006257dd
                                                                                          0x006257e3
                                                                                          0x006257ec
                                                                                          0x006257f2
                                                                                          0x006257fc
                                                                                          0x00625802
                                                                                          0x00625809
                                                                                          0x0062580c
                                                                                          0x00625812
                                                                                          0x00625815
                                                                                          0x00625829
                                                                                          0x00625853
                                                                                          0x0062585a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00625866
                                                                                          0x00625871
                                                                                          0x00625871
                                                                                          0x00625866
                                                                                          0x0062587d
                                                                                          0x0062587e
                                                                                          0x00625883
                                                                                          0x00625886
                                                                                          0x006258a9
                                                                                          0x006258b0
                                                                                          0x006258b7
                                                                                          0x006258b7
                                                                                          0x006258be
                                                                                          0x006258bf
                                                                                          0x006258c4
                                                                                          0x006258c7
                                                                                          0x006258ca
                                                                                          0x006258e4
                                                                                          0x006258eb
                                                                                          0x006258eb
                                                                                          0x006258fa
                                                                                          0x006258ff
                                                                                          0x00625914
                                                                                          0x0062591f
                                                                                          0x00625939
                                                                                          0x00625943
                                                                                          0x0062594d
                                                                                          0x00625953
                                                                                          0x0062596a
                                                                                          0x00625975
                                                                                          0x0062597b
                                                                                          0x0062598d
                                                                                          0x00625994
                                                                                          0x00625994
                                                                                          0x00625999
                                                                                          0x0062599d
                                                                                          0x006259a4
                                                                                          0x006259aa
                                                                                          0x006259b0
                                                                                          0x006259b5
                                                                                          0x006259bc
                                                                                          0x006259c4
                                                                                          0x006259ca
                                                                                          0x006259de
                                                                                          0x006259e5
                                                                                          0x006259e8
                                                                                          0x006259eb
                                                                                          0x006259f9

                                                                                          APIs
                                                                                          • GetTickCount.KERNEL32 ref: 006257BC
                                                                                          • QueryPerformanceCounter.KERNEL32(02497ED0,00000000,00625A4F,?,?,02497ED0,00000000,?,0062644E,?,02497ED0,00000000), ref: 006257C5
                                                                                          • GetSystemTimeAsFileTime.KERNEL32(02497ED0,02497ED0,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 006257CF
                                                                                          • GetCurrentProcessId.KERNEL32(?,02497ED0,00000000,00625A4F,?,?,02497ED0,00000000,?,0062644E,?,02497ED0,00000000), ref: 006257D8
                                                                                          • CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0062584E
                                                                                          • GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0062585C
                                                                                          • CreateFileW.KERNEL32(00000000,C0000000,00000000,006CD098,00000003,00000000,00000000,00000000,00625A0B,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 006258A4
                                                                                          • SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,006259FA,?,00000000,C0000000,00000000,006CD098,00000003,00000000,00000000,00000000,00625A0B), ref: 006258DD
                                                                                            • Part of subcall function 005C745C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C746F
                                                                                          • CreateProcessW.KERNEL32 ref: 00625986
                                                                                          • CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 006259BC
                                                                                          • CloseHandle.KERNEL32(000000FF,00625A01,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 006259F4
                                                                                            • Part of subcall function 0060CE84: GetLastError.KERNEL32(00000000,0060DBAA,00000005,00000000,0060DBD2,?,?,006D579C,?,00000000,00000000,00000000,?,006B910F,00000000,006B912A), ref: 0060CE87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
                                                                                          • String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
                                                                                          • API String ID: 770386003-3271284199
                                                                                          • Opcode ID: 02234b41330c8287713d02d2e420207e79142292eb4e7b079d03f3886e160e1b
                                                                                          • Instruction ID: 34d3d620ae4a6a58b4d890a55742d975a8112a0372845dc610fa96f79e58b5cb
                                                                                          • Opcode Fuzzy Hash: 02234b41330c8287713d02d2e420207e79142292eb4e7b079d03f3886e160e1b
                                                                                          • Instruction Fuzzy Hash: 21717F70E407589EDB20EFB9DC46B9EBBB6EF09304F1041A9F509EB282D77499408F65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006A60E8 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 79%
                                                                                          			E006A60E8(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				DWORD* _v16;
				struct _SHELLEXECUTEINFOW _v76;
				long _t41;
				intOrPtr _t69;
				void* _t71;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t73 = _t74;
				_t75 = _t74 + 0xffffffb8;
				_v8 = 0;
				_v12 = 0;
				_v16 = __ecx;
				_t71 = __edx;
				_t60 = __eax;
				_push(_t73);
				_push(0x6a6237);
				 *[fs:eax] = _t75;
				E006A5F04(__eax,  &_v8,  *[fs:eax]);
				E006A6014( &_v12, _t60, _t71);
				E00407760( &_v76, 0x3c);
				_v76.cbSize = 0x3c;
				_v76.fMask = 0x800540;
				_v76.lpVerb = L"runas";
				_v76.lpFile = E0040B278(_v8);
				_v76.lpParameters = E0040B278(_t71);
				_v76.lpDirectory = E0040B278(_v12);
				_v76.nShow = 1;
				if(ShellExecuteExW( &_v76) == 0) {
					if(GetLastError() == 0x4c7) {
						E00428FDC();
					}
					E0060CE84(L"ShellExecuteEx");
				}
				if(_v76.hProcess == 0) {
					E0060CD28(L"ShellExecuteEx returned hProcess=0", _t60);
				}
				_push(_t73);
				_push(0x6a6215);
				_push( *[fs:edx]);
				 *[fs:edx] = _t75;
				do {
					E006A5C10();
					_t41 = MsgWaitForMultipleObjects(1,  &(_v76.hProcess), 0, 0xffffffff, 0x4ff);
				} while (_t41 == 1);
				if(_t41 == 0xffffffff) {
					E0060CE84(L"MsgWaitForMultipleObjects");
				}
				E006A5C10();
				if(GetExitCodeProcess(_v76.hProcess, _v16) == 0) {
					E0060CE84(L"GetExitCodeProcess");
				}
				_pop(_t69);
				 *[fs:eax] = _t69;
				_push(E006A621C);
				return CloseHandle(_v76.hProcess);
			}













                                                                                          0x006a60e9
                                                                                          0x006a60eb
                                                                                          0x006a60f2
                                                                                          0x006a60f5
                                                                                          0x006a60f8
                                                                                          0x006a60fb
                                                                                          0x006a60fd
                                                                                          0x006a6101
                                                                                          0x006a6102
                                                                                          0x006a610a
                                                                                          0x006a6112
                                                                                          0x006a611a
                                                                                          0x006a6129
                                                                                          0x006a612e
                                                                                          0x006a6135
                                                                                          0x006a6141
                                                                                          0x006a614c
                                                                                          0x006a6156
                                                                                          0x006a6161
                                                                                          0x006a6164
                                                                                          0x006a6176
                                                                                          0x006a6182
                                                                                          0x006a6184
                                                                                          0x006a6184
                                                                                          0x006a618e
                                                                                          0x006a618e
                                                                                          0x006a6197
                                                                                          0x006a619e
                                                                                          0x006a619e
                                                                                          0x006a61a5
                                                                                          0x006a61a6
                                                                                          0x006a61ab
                                                                                          0x006a61ae
                                                                                          0x006a61b1
                                                                                          0x006a61b1
                                                                                          0x006a61c5
                                                                                          0x006a61ca
                                                                                          0x006a61d2
                                                                                          0x006a61d9
                                                                                          0x006a61d9
                                                                                          0x006a61de
                                                                                          0x006a61f2
                                                                                          0x006a61f9
                                                                                          0x006a61f9
                                                                                          0x006a6200
                                                                                          0x006a6203
                                                                                          0x006a6206
                                                                                          0x006a6214

                                                                                          APIs
                                                                                            • Part of subcall function 006A5F04: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F30
                                                                                            • Part of subcall function 006A5F04: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F49
                                                                                            • Part of subcall function 006A5F04: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F73
                                                                                            • Part of subcall function 006A5F04: CloseHandle.KERNEL32(00000000), ref: 006A5F91
                                                                                            • Part of subcall function 006A6014: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,006A60A5,?,00000097,00000000,?,006A611F,00000000,006A6237,?,?,00000001), ref: 006A6043
                                                                                          • ShellExecuteExW.SHELL32(0000003C), ref: 006A616F
                                                                                          • GetLastError.KERNEL32(0000003C,00000000,006A6237,?,?,00000001), ref: 006A6178
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 006A61C5
                                                                                          • GetExitCodeProcess.KERNEL32 ref: 006A61EB
                                                                                          • CloseHandle.KERNEL32(00000000,006A621C,00000000,00000000,000000FF,000004FF,00000000,006A6215,?,0000003C,00000000,006A6237,?,?,00000001), ref: 006A620F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
                                                                                          • String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
                                                                                          • API String ID: 254331816-221126205
                                                                                          • Opcode ID: 50ab56e846dc80d15c01923507bf6790d6aa311175c67b185781c44098e97bf0
                                                                                          • Instruction ID: 3b593d6e4f6188ec2893085c4d8bc70e2010c955c7988aee54b7ca20d83eebf0
                                                                                          • Opcode Fuzzy Hash: 50ab56e846dc80d15c01923507bf6790d6aa311175c67b185781c44098e97bf0
                                                                                          • Instruction Fuzzy Hash: 4931AF70A00208AFDB10FFE9C842A9DBABAEF06314F44053DF514E62D2D7789E448F29
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040E0D4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 78%
                                                                                          			E0040E0D4(short* __eax, intOrPtr __edx) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				void* _t55;
				signed int _t88;
				signed int _t89;
				intOrPtr* _t90;
				signed int _t101;
				signed int _t102;
				short* _t112;
				struct HINSTANCE__* _t113;
				short* _t115;
				short* _t116;
				void* _t117;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t113 = GetModuleHandleW(L"kernel32.dll");
				if(_t113 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t115 = _v8 + 4;
						goto L10;
					} else {
						if( *((short*)(_v8 + 2)) == 0x5c) {
							_t116 = E0040E0B0(_v8 + 4);
							if( *_t116 != 0) {
								_t14 = _t116 + 2; // 0x2
								_t115 = E0040E0B0(_t14);
								if( *_t115 != 0) {
									L10:
									_t88 = _t115 - _v8;
									_t89 = _t88 >> 1;
									if(_t88 < 0) {
										asm("adc ebx, 0x0");
									}
									_t43 = _t89 + 1;
									if(_t89 + 1 <= 0x105) {
										E0040DAF8( &_v1134, _v8, _t43);
										while( *_t115 != 0) {
											_t112 = E0040E0B0(_t115 + 2);
											_t50 = _t112 - _t115;
											_t51 = _t50 >> 1;
											if(_t50 < 0) {
												asm("adc eax, 0x0");
											}
											if(_t51 + _t89 + 1 <= 0x105) {
												_t55 =  &_v1134 + _t89 + _t89;
												_t101 = _t112 - _t115;
												_t102 = _t101 >> 1;
												if(_t101 < 0) {
													asm("adc edx, 0x0");
												}
												E0040DAF8(_t55, _t115, _t102 + 1);
												_v20 = FindFirstFileW( &_v1134,  &_v612);
												if(_v20 != 0xffffffff) {
													FindClose(_v20);
													if(lstrlenW( &(_v612.cFileName)) + _t89 + 1 + 1 <= 0x105) {
														 *((short*)(_t117 + _t89 * 2 - 0x46a)) = 0x5c;
														E0040DAF8( &_v1134 + _t89 + _t89 + 2,  &(_v612.cFileName), 0x105 - _t89 - 1);
														_t89 = _t89 + lstrlenW( &(_v612.cFileName)) + 1;
														_t115 = _t112;
														continue;
													}
												}
											}
											goto L24;
										}
										E0040DAF8(_v8,  &_v1134, _v12);
									}
								}
							}
						}
					}
				} else {
					_t90 = GetProcAddress(_t113, "GetLongPathNameW");
					if(_t90 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t90() == 0) {
							goto L4;
						} else {
							E0040DAF8(_v8,  &_v1134, _v12);
						}
					}
				}
				L24:
				return _v16;
			}






















                                                                                          0x0040e0e0
                                                                                          0x0040e0e3
                                                                                          0x0040e0e9
                                                                                          0x0040e0f6
                                                                                          0x0040e0fa
                                                                                          0x0040e139
                                                                                          0x0040e140
                                                                                          0x0040e180
                                                                                          0x00000000
                                                                                          0x0040e142
                                                                                          0x0040e14a
                                                                                          0x0040e15b
                                                                                          0x0040e161
                                                                                          0x0040e167
                                                                                          0x0040e16f
                                                                                          0x0040e175
                                                                                          0x0040e183
                                                                                          0x0040e185
                                                                                          0x0040e188
                                                                                          0x0040e18a
                                                                                          0x0040e18c
                                                                                          0x0040e18c
                                                                                          0x0040e18f
                                                                                          0x0040e197
                                                                                          0x0040e1a8
                                                                                          0x0040e26f
                                                                                          0x0040e1ba
                                                                                          0x0040e1be
                                                                                          0x0040e1c0
                                                                                          0x0040e1c2
                                                                                          0x0040e1c4
                                                                                          0x0040e1c4
                                                                                          0x0040e1cf
                                                                                          0x0040e1df
                                                                                          0x0040e1e3
                                                                                          0x0040e1e5
                                                                                          0x0040e1e7
                                                                                          0x0040e1e9
                                                                                          0x0040e1e9
                                                                                          0x0040e1ef
                                                                                          0x0040e207
                                                                                          0x0040e20e
                                                                                          0x0040e214
                                                                                          0x0040e230
                                                                                          0x0040e232
                                                                                          0x0040e259
                                                                                          0x0040e26b
                                                                                          0x0040e26d
                                                                                          0x00000000
                                                                                          0x0040e26d
                                                                                          0x0040e230
                                                                                          0x0040e20e
                                                                                          0x00000000
                                                                                          0x0040e1cf
                                                                                          0x0040e285
                                                                                          0x0040e285
                                                                                          0x0040e197
                                                                                          0x0040e175
                                                                                          0x0040e161
                                                                                          0x0040e14a
                                                                                          0x0040e0fc
                                                                                          0x0040e107
                                                                                          0x0040e10b
                                                                                          0x00000000
                                                                                          0x0040e10d
                                                                                          0x0040e10d
                                                                                          0x0040e118
                                                                                          0x0040e11c
                                                                                          0x0040e121
                                                                                          0x00000000
                                                                                          0x0040e123
                                                                                          0x0040e12f
                                                                                          0x0040e12f
                                                                                          0x0040e121
                                                                                          0x0040e10b
                                                                                          0x0040e28a
                                                                                          0x0040e293

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,0041D038,?,?), ref: 0040E0F1
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040E102
                                                                                          • FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041D038,?,?), ref: 0040E202
                                                                                          • FindClose.KERNEL32(?,?,?,kernel32.dll,0041D038,?,?), ref: 0040E214
                                                                                          • lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041D038,?,?), ref: 0040E220
                                                                                          • lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041D038,?,?), ref: 0040E265
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                          • String ID: GetLongPathNameW$\$kernel32.dll
                                                                                          • API String ID: 1930782624-3908791685
                                                                                          • Opcode ID: 1e5aa63ad13805ebe641060d55f71927a25656d4bbeb27d65059da7d04647448
                                                                                          • Instruction ID: 85f15f90104044dde56611b048d4fe37091be9da2e2d426f5e1dee482ffdf80d
                                                                                          • Opcode Fuzzy Hash: 1e5aa63ad13805ebe641060d55f71927a25656d4bbeb27d65059da7d04647448
                                                                                          • Instruction Fuzzy Hash: 09418471E005189BCB10DAA6CC85ADEB3B9EF44310F1449FAD504F72C1EB789E568F89
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060F6D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 91%
                                                                                          			E0060F6D8() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t7;

				if(E00429D18() != 2) {
					L5:
					_t7 = ExitWindowsEx(2, 0);
					asm("sbb eax, eax");
					return _t7 + 1;
				}
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) != 0) {
					LookupPrivilegeValueW(0, L"SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() == 0) {
						goto L5;
					}
					return 0;
				}
				return 0;
			}







                                                                                          0x0060f6e3
                                                                                          0x0060f740
                                                                                          0x0060f744
                                                                                          0x0060f74c
                                                                                          0x00000000
                                                                                          0x0060f74e
                                                                                          0x0060f6f5
                                                                                          0x0060f707
                                                                                          0x0060f70c
                                                                                          0x0060f714
                                                                                          0x0060f72e
                                                                                          0x0060f73a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0060f73c
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000028), ref: 0060F6E8
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0060F6EE
                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0060F707
                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0060F72E
                                                                                          • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0060F733
                                                                                          • ExitWindowsEx.USER32 ref: 0060F744
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                          • String ID: SeShutdownPrivilege
                                                                                          • API String ID: 107509674-3733053543
                                                                                          • Opcode ID: 587dd988ce63d715a201a3aa16ee9d515860b21273bb1684cbadb229f2035bc1
                                                                                          • Instruction ID: 06ed2f01938c74524bf5f5b14376f39d724559be6214a1270456cb597724f4e2
                                                                                          • Opcode Fuzzy Hash: 587dd988ce63d715a201a3aa16ee9d515860b21273bb1684cbadb229f2035bc1
                                                                                          • Instruction Fuzzy Hash: 8EF090306E430276E624AF719C47FEB218D9B40B09F50092DF644D61C1DBA9E589826B
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006A68B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 74%
                                                                                          			E006A68B0(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4, short* _a8, intOrPtr _a12, void* _a16, char _a20, intOrPtr _a24, intOrPtr* _a32, intOrPtr _a36, intOrPtr* _a40, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52) {
				char _v5;
				intOrPtr _v12;
				struct HWND__* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v60;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char _v120;
				intOrPtr _t69;
				intOrPtr* _t70;
				intOrPtr* _t74;
				signed int _t77;
				signed int _t78;
				intOrPtr* _t79;
				signed int _t82;
				signed int _t83;
				short* _t87;
				intOrPtr _t106;
				intOrPtr _t123;
				void* _t125;
				char _t126;
				intOrPtr* _t127;
				intOrPtr _t136;
				intOrPtr _t140;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr* _t148;
				void* _t150;
				void* _t151;
				intOrPtr _t152;
				intOrPtr _t164;

				_t150 = _t151;
				_t152 = _t151 + 0xffffff8c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t147 = __ecx;
				_t123 = __edx;
				_t145 = __eax;
				_push(_t150);
				_push(0x6a6acd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t152;
				if( *0x6d648c == 0) {
					_v5 = 0;
					__eflags = 0;
					_pop(_t136);
					 *[fs:eax] = _t136;
					_push(E006A6AD4);
					return 0;
				} else {
					E00407760( &_v120, 0x60);
					_v120 = 0x60;
					if(_a20 != 0) {
						_v108 = _v108 | 0x00002000;
					}
					_t69 =  *0x6d2634; // 0x400000
					_v112 = _t69;
					_t70 =  *0x6cdec4; // 0x6d579c
					if(IsIconic( *( *_t70 + 0x188)) == 0) {
						_t74 =  *0x6cdec4; // 0x6d579c
						_t77 = GetWindowLongW( *( *_t74 + 0x188), 0xfffffff0);
						__eflags = _t77 & 0x10000000;
						_t12 = (_t77 & 0x10000000) == 0;
						__eflags = _t12;
						_t78 = _t77 & 0xffffff00 | _t12;
					} else {
						_t78 = 1;
					}
					if(_t78 == 0) {
						_t79 =  *0x6cdec4; // 0x6d579c
						_t82 = GetWindowLongW( *( *_t79 + 0x188), 0xffffffec);
						__eflags = _t82 & 0x00000080;
						_t17 = (_t82 & 0x00000080) != 0;
						__eflags = _t17;
						_t83 = _t82 & 0xffffff00 | _t17;
					} else {
						_t83 = 1;
					}
					if(_t83 == 0) {
						_v116 = _t145;
					} else {
						_v116 = 0;
					}
					_v104 = _a44;
					_v100 = _a52;
					_v96 = _a48;
					_v92 = _t123;
					_v88 = _t147;
					_t87 = _a8;
					if(_t87 != 0 &&  *_t87 != 0) {
						_v60 = _a8;
					}
					if(_a24 != 0) {
						_v36 = 0x6a6888;
						_v32 = _a24;
					}
					_v12 = 0;
					_push(_t150);
					_push(0x6a6ab4);
					_push( *[fs:edx]);
					 *[fs:edx] = _t152;
					_t125 = _a36 + 1;
					if(_t125 != 0) {
						_t106 =  *0x54808c; // 0x5480e4
						_v12 = E00466A64(0, 1, _t145, _t106);
						_v108 = _v108 | 0x00000010;
						_t125 = _t125 - 1;
						if(_t125 >= 0) {
							_t126 = _t125 + 1;
							_t164 = _t126;
							_v24 = _t126;
							_t127 = _a40;
							_t148 = _a32;
							do {
								_t145 = E0054BA48(_v12);
								E0054B708(_t145,  *_t127, _t164);
								 *((intOrPtr*)(_t145 + 0x18)) =  *_t148;
								_t148 = _t148 + 4;
								_t127 = _t127 + 4;
								_t45 =  &_v24;
								 *_t45 = _v24 - 1;
							} while ( *_t45 != 0);
						}
						_v80 = E0054BA54(_v12);
						_v84 =  *((intOrPtr*)( *((intOrPtr*)(_v12 + 8)) + 8));
					}
					E005C9060();
					_v16 = GetActiveWindow();
					_v20 = E005ABB4C(0, _t125, _t145, _t147);
					 *[fs:eax] = _t152;
					_v5 =  *0x6d648c( &_v120, _a12, 0, _a4,  *[fs:eax], 0x6a6a97, _t150) == 0;
					_pop(_t140);
					 *[fs:eax] = _t140;
					_push(E006A6A9E);
					E005ABC0C(_v20);
					SetActiveWindow(_v16);
					return E005C9060();
				}
			}













































                                                                                          0x006a68b1
                                                                                          0x006a68b3
                                                                                          0x006a68b6
                                                                                          0x006a68b7
                                                                                          0x006a68b8
                                                                                          0x006a68b9
                                                                                          0x006a68bb
                                                                                          0x006a68bd
                                                                                          0x006a68c1
                                                                                          0x006a68c2
                                                                                          0x006a68c7
                                                                                          0x006a68ca
                                                                                          0x006a68d4
                                                                                          0x006a6abb
                                                                                          0x006a6abf
                                                                                          0x006a6ac1
                                                                                          0x006a6ac4
                                                                                          0x006a6ac7
                                                                                          0x006a6acc
                                                                                          0x006a68da
                                                                                          0x006a68e4
                                                                                          0x006a68e9
                                                                                          0x006a68f4
                                                                                          0x006a68f6
                                                                                          0x006a68f6
                                                                                          0x006a68fd
                                                                                          0x006a6902
                                                                                          0x006a6905
                                                                                          0x006a691a
                                                                                          0x006a6920
                                                                                          0x006a6930
                                                                                          0x006a6935
                                                                                          0x006a693a
                                                                                          0x006a693a
                                                                                          0x006a693a
                                                                                          0x006a691c
                                                                                          0x006a691c
                                                                                          0x006a691c
                                                                                          0x006a693f
                                                                                          0x006a6945
                                                                                          0x006a6955
                                                                                          0x006a695a
                                                                                          0x006a695c
                                                                                          0x006a695c
                                                                                          0x006a695c
                                                                                          0x006a6941
                                                                                          0x006a6941
                                                                                          0x006a6941
                                                                                          0x006a6961
                                                                                          0x006a696a
                                                                                          0x006a6963
                                                                                          0x006a6965
                                                                                          0x006a6965
                                                                                          0x006a6970
                                                                                          0x006a6976
                                                                                          0x006a697c
                                                                                          0x006a697f
                                                                                          0x006a6982
                                                                                          0x006a6985
                                                                                          0x006a698a
                                                                                          0x006a6995
                                                                                          0x006a6995
                                                                                          0x006a699c
                                                                                          0x006a699e
                                                                                          0x006a69a8
                                                                                          0x006a69a8
                                                                                          0x006a69ad
                                                                                          0x006a69b2
                                                                                          0x006a69b3
                                                                                          0x006a69b8
                                                                                          0x006a69bb
                                                                                          0x006a69c1
                                                                                          0x006a69c4
                                                                                          0x006a69c6
                                                                                          0x006a69da
                                                                                          0x006a69dd
                                                                                          0x006a69e1
                                                                                          0x006a69e4
                                                                                          0x006a69e6
                                                                                          0x006a69e6
                                                                                          0x006a69e7
                                                                                          0x006a69ea
                                                                                          0x006a69ed
                                                                                          0x006a69f0
                                                                                          0x006a69f8
                                                                                          0x006a69fe
                                                                                          0x006a6a05
                                                                                          0x006a6a08
                                                                                          0x006a6a0b
                                                                                          0x006a6a0e
                                                                                          0x006a6a0e
                                                                                          0x006a6a0e
                                                                                          0x006a69f0
                                                                                          0x006a6a1b
                                                                                          0x006a6a27
                                                                                          0x006a6a27
                                                                                          0x006a6a2f
                                                                                          0x006a6a39
                                                                                          0x006a6a43
                                                                                          0x006a6a51
                                                                                          0x006a6a6a
                                                                                          0x006a6a70
                                                                                          0x006a6a73
                                                                                          0x006a6a76
                                                                                          0x006a6a7e
                                                                                          0x006a6a87
                                                                                          0x006a6a96
                                                                                          0x006a6a96

                                                                                          APIs
                                                                                          • IsIconic.USER32 ref: 006A6913
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 006A6930
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 006A6955
                                                                                            • Part of subcall function 005ABC0C: IsWindow.USER32(8B565300), ref: 005ABC1A
                                                                                            • Part of subcall function 005ABC0C: EnableWindow.USER32(8B565300,000000FF), ref: 005ABC29
                                                                                          • GetActiveWindow.USER32 ref: 006A6A34
                                                                                          • SetActiveWindow.USER32(006C479A,006A6A9E,006A6AB4,?,?,000000EC,?,000000F0,?,00000000,006A6ACD,?,00000000,?,00000000), ref: 006A6A87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveLong$EnableIconic
                                                                                          • String ID: `
                                                                                          • API String ID: 4222481217-2679148245
                                                                                          • Opcode ID: cde2a6536f5044e3bc4238d2ffbe734793dbf8fec1bfd9d9ee3b4b44e3c8bba9
                                                                                          • Instruction ID: 936cf99dd23b6ce25ef8ab77046748165037aff960be166beb91cb3f54ae6a19
                                                                                          • Opcode Fuzzy Hash: cde2a6536f5044e3bc4238d2ffbe734793dbf8fec1bfd9d9ee3b4b44e3c8bba9
                                                                                          • Instruction Fuzzy Hash: C3611875A002099FDB00EFA9C885A9EBBF6FB4A304F598469F914EB361D734AD41CF50
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B8DE4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 63%
                                                                                          			E006B8DE4(void* __eax, void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				struct _WIN32_FIND_DATAW _v604;
				char _v608;
				char _v612;
				void* _t59;
				intOrPtr _t70;
				intOrPtr _t73;
				signed int _t77;
				void* _t80;
				void* _t81;
				intOrPtr _t82;

				_t80 = _t81;
				_t82 = _t81 + 0xfffffda0;
				_v612 = 0;
				_v608 = 0;
				_v8 = 0;
				_t59 = __eax;
				_push(_t80);
				_push(0x6b8f21);
				_push( *[fs:eax]);
				 *[fs:eax] = _t82;
				E0040B4C8( &_v608, L"isRS-???.tmp", __eax);
				_v12 = FindFirstFileW(E0040B278(_v608),  &_v604);
				if(_v12 == 0xffffffff) {
					_pop(_t70);
					 *[fs:eax] = _t70;
					_push(E006B8F28);
					E0040A228( &_v612, 2);
					return E0040A1C8( &_v8);
				} else {
					_push(_t80);
					_push(0x6b8ef4);
					_push( *[fs:eax]);
					 *[fs:eax] = _t82;
					do {
						if(E004241A0( &(_v604.cFileName), 5, L"isRS-") == 0 && (_v604.dwFileAttributes & 0x00000010) == 0) {
							E0040B318( &_v612, 0x104,  &(_v604.cFileName));
							E0040B4C8( &_v8, _v612, _t59);
							_t77 = _v604.dwFileAttributes;
							if((_t77 & 0x00000001) != 0) {
								SetFileAttributesW(E0040B278(_v8), _t77 & 0xfffffffe);
							}
							E00423A20(_v8);
						}
					} while (FindNextFileW(_v12,  &_v604) != 0);
					_pop(_t73);
					 *[fs:eax] = _t73;
					_push(E006B8EFB);
					return FindClose(_v12);
				}
			}















                                                                                          0x006b8de5
                                                                                          0x006b8de7
                                                                                          0x006b8df1
                                                                                          0x006b8df7
                                                                                          0x006b8dfd
                                                                                          0x006b8e00
                                                                                          0x006b8e04
                                                                                          0x006b8e05
                                                                                          0x006b8e0a
                                                                                          0x006b8e0d
                                                                                          0x006b8e24
                                                                                          0x006b8e3a
                                                                                          0x006b8e41
                                                                                          0x006b8efd
                                                                                          0x006b8f00
                                                                                          0x006b8f03
                                                                                          0x006b8f13
                                                                                          0x006b8f20
                                                                                          0x006b8e47
                                                                                          0x006b8e49
                                                                                          0x006b8e4a
                                                                                          0x006b8e4f
                                                                                          0x006b8e52
                                                                                          0x006b8e55
                                                                                          0x006b8e6c
                                                                                          0x006b8e88
                                                                                          0x006b8e98
                                                                                          0x006b8e9d
                                                                                          0x006b8ea9
                                                                                          0x006b8eb8
                                                                                          0x006b8eb8
                                                                                          0x006b8ec0
                                                                                          0x006b8ec0
                                                                                          0x006b8ed5
                                                                                          0x006b8edf
                                                                                          0x006b8ee2
                                                                                          0x006b8ee5
                                                                                          0x006b8ef3
                                                                                          0x006b8ef3

                                                                                          APIs
                                                                                          • FindFirstFileW.KERNEL32(00000000,?,00000000,006B8F21,?,006D579C,?,?,006B90D6,00000000,006B912A,?,00000000,00000000,00000000), ref: 006B8E35
                                                                                          • SetFileAttributesW.KERNEL32(00000000,00000010), ref: 006B8EB8
                                                                                          • FindNextFileW.KERNEL32(000000FF,?,00000000,006B8EF4,?,00000000,?,00000000,006B8F21,?,006D579C,?,?,006B90D6,00000000,006B912A), ref: 006B8ED0
                                                                                          • FindClose.KERNEL32(000000FF,006B8EFB,006B8EF4,?,00000000,?,00000000,006B8F21,?,006D579C,?,?,006B90D6,00000000,006B912A), ref: 006B8EEE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileFind$AttributesCloseFirstNext
                                                                                          • String ID: isRS-$isRS-???.tmp
                                                                                          • API String ID: 134685335-3422211394
                                                                                          • Opcode ID: c93273faac10569b33b09ffebc3332b52a89e798d60aebe0743ded46c55c2400
                                                                                          • Instruction ID: d39c6702953267373b2098697dd7c4daff6c19a754f4e73b98016d5d2bb0ed42
                                                                                          • Opcode Fuzzy Hash: c93273faac10569b33b09ffebc3332b52a89e798d60aebe0743ded46c55c2400
                                                                                          • Instruction Fuzzy Hash: E6317670A006189FDB10DF65DC45ADEB7BEEB84304F5145FAE804A3291EB389E81CB58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C90B4 Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 65%
                                                                                          			E005C90B4(WCHAR* __eax, void* __ebx, signed int __ecx, WCHAR* __edx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct HWND__* _v16;
				intOrPtr _v20;
				intOrPtr* _t28;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr* _t37;
				signed int _t41;
				intOrPtr* _t43;
				WCHAR* _t62;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				WCHAR* _t78;
				void* _t80;
				void* _t81;
				intOrPtr _t82;

				_t76 = __edi;
				_t80 = _t81;
				_t82 = _t81 + 0xfffffff0;
				_push(__ebx);
				_push(__esi);
				_v8 = __ecx;
				_t78 = __edx;
				_t62 = __eax;
				if( *0x6d5814 != 0) {
					_v8 = _v8 | 0x00180000;
				}
				E005C9060();
				_push(_t80);
				_push(0x5c91da);
				_push( *[fs:edx]);
				 *[fs:edx] = _t82;
				_t28 =  *0x6cdec4; // 0x6d579c
				if(IsIconic( *( *_t28 + 0x188)) == 0) {
					_t32 =  *0x6cdec4; // 0x6d579c
					_t36 = GetWindowLongW( *( *_t32 + 0x188), 0xfffffff0) & 0xffffff00 | (_t35 & 0x10000000) == 0x00000000;
				} else {
					_t36 = 1;
				}
				if(_t36 == 0) {
					_t37 =  *0x6cdec4; // 0x6d579c
					_t41 = GetWindowLongW( *( *_t37 + 0x188), 0xffffffec) & 0xffffff00 | (_t40 & 0x00000080) != 0x00000000;
				} else {
					_t41 = 1;
				}
				if(_t41 == 0) {
					_t43 =  *0x6cdec4; // 0x6d579c
					_v12 = E005B8BCC( *_t43, _t62, _t78, _t62, _t76, _t78, _v8);
					_pop(_t73);
					 *[fs:eax] = _t73;
					_push(E005C91E1);
					return E005C9060();
				} else {
					_v16 = GetActiveWindow();
					_v20 = E005ABB4C(0, _t62, _t76, _t78);
					_push(_t80);
					_push(0x5c919d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t82;
					_v12 = MessageBoxW(0, _t62, _t78, _v8 | 0x00002000);
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E005C91A4);
					E005ABC0C(_v20);
					return SetActiveWindow(_v16);
				}
			}





















                                                                                          0x005c90b4
                                                                                          0x005c90b5
                                                                                          0x005c90b7
                                                                                          0x005c90ba
                                                                                          0x005c90bb
                                                                                          0x005c90bc
                                                                                          0x005c90bf
                                                                                          0x005c90c1
                                                                                          0x005c90ca
                                                                                          0x005c90cc
                                                                                          0x005c90cc
                                                                                          0x005c90d8
                                                                                          0x005c90df
                                                                                          0x005c90e0
                                                                                          0x005c90e5
                                                                                          0x005c90e8
                                                                                          0x005c90eb
                                                                                          0x005c9100
                                                                                          0x005c9106
                                                                                          0x005c9120
                                                                                          0x005c9102
                                                                                          0x005c9102
                                                                                          0x005c9102
                                                                                          0x005c9125
                                                                                          0x005c912b
                                                                                          0x005c9142
                                                                                          0x005c9127
                                                                                          0x005c9127
                                                                                          0x005c9127
                                                                                          0x005c9147
                                                                                          0x005c91af
                                                                                          0x005c91bf
                                                                                          0x005c91c4
                                                                                          0x005c91c7
                                                                                          0x005c91ca
                                                                                          0x005c91d9
                                                                                          0x005c9149
                                                                                          0x005c914e
                                                                                          0x005c9158
                                                                                          0x005c915d
                                                                                          0x005c915e
                                                                                          0x005c9163
                                                                                          0x005c9166
                                                                                          0x005c917b
                                                                                          0x005c9180
                                                                                          0x005c9183
                                                                                          0x005c9186
                                                                                          0x005c918e
                                                                                          0x005c919c
                                                                                          0x005c919c

                                                                                          APIs
                                                                                          • IsIconic.USER32 ref: 005C90F9
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 005C9116
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 005C913B
                                                                                          • GetActiveWindow.USER32 ref: 005C9149
                                                                                          • MessageBoxW.USER32(00000000,00000000,?,000000E5), ref: 005C9176
                                                                                          • SetActiveWindow.USER32(00000000,005C91A4,000000E5,00000000,005C919D,?,?,000000EC,?,000000F0,?,00000000,005C91DA,?,?,00000000), ref: 005C9197
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveLong$IconicMessage
                                                                                          • String ID:
                                                                                          • API String ID: 1633107849-0
                                                                                          • Opcode ID: 508d3fe12e956fb13021e77f6491858a72c00fd2473886cd708834c9feb3ad3b
                                                                                          • Instruction ID: 0eaebbc0e28104152e09dfddf635ce6469108de93c670a6b66e2a7222b47ea08
                                                                                          • Opcode Fuzzy Hash: 508d3fe12e956fb13021e77f6491858a72c00fd2473886cd708834c9feb3ad3b
                                                                                          • Instruction Fuzzy Hash: 4F319375A04605AFDB00EFA9DD4AF9A7BF9FB89350B1544A9F400D73A1DB34AD00DB14
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C8B3C Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005C8B3C(void* __eax) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				void* _t18;
				intOrPtr _t19;

				_t18 = __eax;
				InitializeSecurityDescriptor( &_v36, 1);
				SetSecurityDescriptorDacl( &_v36, 0xffffffff, 0, 0);
				_v16 = 0xc;
				_v12 = _t19;
				_v8 = 0;
				return E00413E90( &_v16, 0, E0040B278(_t18));
			}









                                                                                          0x005c8b40
                                                                                          0x005c8b49
                                                                                          0x005c8b59
                                                                                          0x005c8b5e
                                                                                          0x005c8b68
                                                                                          0x005c8b6e
                                                                                          0x005c8b8a

                                                                                          APIs
                                                                                          • InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 005C8B49
                                                                                          • SetSecurityDescriptorDacl.ADVAPI32(00000000,000000FF,00000000,00000000,00000001,00000001), ref: 005C8B59
                                                                                            • Part of subcall function 00413E90: CreateMutexW.KERNEL32(?,?,?,?,006B91D7,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B94FD,?,?,00000000), ref: 00413EA6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DescriptorSecurity$CreateDaclInitializeMutex
                                                                                          • String ID:
                                                                                          • API String ID: 3525989157-0
                                                                                          • Opcode ID: 4f1f08f05653286ea2b7b56adace897cf1bc07cb32d1fd1b56cd53636393a7b3
                                                                                          • Instruction ID: 330012b0c6753e8d8900aa9d7e53afb48d76169d5e03c13c529c7fe63a2e2798
                                                                                          • Opcode Fuzzy Hash: 4f1f08f05653286ea2b7b56adace897cf1bc07cb32d1fd1b56cd53636393a7b3
                                                                                          • Instruction Fuzzy Hash: E9E092B16443006FE700DFB58C86F9B77DC9B84725F104A2EB664DB2C1E778DA48879A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B9138 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 260COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 73%
                                                                                          			E006B9138(char __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v21;
				signed int _v22;
				void* _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v60;
				void* _t62;
				signed int _t110;
				intOrPtr _t129;
				signed int _t130;
				char _t134;
				char _t139;
				char _t142;
				char* _t149;
				intOrPtr* _t158;
				void* _t159;
				intOrPtr _t181;
				intOrPtr _t189;
				intOrPtr _t190;
				intOrPtr _t192;
				intOrPtr _t196;
				intOrPtr _t199;
				intOrPtr* _t204;
				intOrPtr _t206;
				intOrPtr _t207;
				void* _t216;

				_t216 = __fp0;
				_t202 = __edi;
				_t157 = __ebx;
				_t206 = _t207;
				_t159 = 7;
				do {
					_push(0);
					_push(0);
					_t159 = _t159 - 1;
				} while (_t159 != 0);
				_push(__ebx);
				_push(__edi);
				_t204 =  *0x6cdec4; // 0x6d579c
				_push(_t206);
				_push(0x6b94fd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t207;
				E005C6FB0(1, __ebx,  &_v36, __edi, _t204);
				_t62 = E00422368(_v36, _t159, L"/REG");
				_t209 = _t62;
				if(_t62 != 0) {
					E005C6FB0(1, __ebx,  &_v40, __edi, _t204);
					__eflags = E00422368(_v40, _t159, L"/REGU");
					if(__eflags != 0) {
						__eflags = 0;
						_pop(_t181);
						 *[fs:eax] = _t181;
						_push(E006B9504);
						E0040A228( &_v60, 7);
						return E0040A228( &_v20, 4);
					} else {
						_v21 = 0;
						goto L6;
					}
				} else {
					_v21 = 1;
					L6:
					E005B8250( *_t204, L"Setup", _t209);
					ShowWindow( *( *_t204 + 0x188), 5);
					E006AF824();
					_v28 = E00413E90(0, 0, L"Inno-Setup-RegSvr-Mutex");
					ShowWindow( *( *_t204 + 0x188), 0);
					if(_v28 != 0) {
						do {
							E005B8704( *_t204);
						} while (MsgWaitForMultipleObjects(1,  &_v28, 0, 0xffffffff, 0x4ff) == 1);
					}
					ShowWindow( *( *_t204 + 0x188), 5);
					_push(_t206);
					_push(0x6b94ce);
					_push( *[fs:eax]);
					 *[fs:eax] = _t207;
					E005C6FB0(0, _t157,  &_v44, _t202, _t204);
					E005C4F90(_v44, _t157,  &_v8, L".msg", _t202, _t204);
					E005C6FB0(0, _t157,  &_v48, _t202, _t204);
					E005C4F90(_v48, _t157,  &_v12, L".lst", _t202, _t204);
					if(E005C685C(_v12) == 0) {
						E00423A20(_v12);
						E00423A20(_v8);
						_push(_t206);
						_push( *[fs:eax]);
						 *[fs:eax] = _t207;
						E006B9098(_t157,  &_v12, _t202, _t204, __eflags);
						_pop(_t189);
						 *[fs:eax] = _t189;
						_t190 = 0x6b949e;
						 *[fs:eax] = _t190;
						_push(E006B94D5);
						__eflags = _v28;
						if(_v28 != 0) {
							ReleaseMutex(_v28);
							return CloseHandle(_v28);
						}
						return 0;
					} else {
						E005CD6BC(_v8, _t157, 1, 0, _t202, _t204);
						_t110 =  *0x6cddd0; // 0x6d603c
						E005C9044(_t110 & 0xffffff00 | ( *(_t110 + 0x4c) & 0x00000001) != 0x00000000);
						_t192 =  *0x6cded8; // 0x6d5c28
						_t26 = _t192 + 0x2f8; // 0x24db0ac
						E005B8250( *_t204,  *_t26,  *(_t110 + 0x4c) & 0x00000001);
						_push(_t206);
						_push(0x6b946a);
						_push( *[fs:eax]);
						 *[fs:eax] = _t207;
						E006AC8CC(_t157,  *_t26, _t202, _t204);
						_v32 = E005CBFB8(1, 1, 0, 2);
						_push(_t206);
						_push(0x6b9450);
						_push( *[fs:eax]);
						 *[fs:eax] = _t207;
						while(E005CC258(_v32) == 0) {
							E005CC268(_v32, _t157,  &_v16, _t202, _t204, __eflags);
							_t157 = _v16;
							__eflags = _t157;
							if(_t157 != 0) {
								_t158 = _t157 - 4;
								__eflags = _t158;
								_t157 =  *_t158;
							}
							__eflags = _t157 - 4;
							if(__eflags > 0) {
								__eflags =  *_v16 - 0x5b;
								if(__eflags == 0) {
									__eflags =  *((short*)(_v16 + 6)) - 0x5d;
									if(__eflags == 0) {
										E0040B698(_v16, 0x7fffffff, 5,  &_v20);
										_t129 = _v16;
										__eflags =  *((short*)(_t129 + 4)) - 0x71;
										if( *((short*)(_t129 + 4)) == 0x71) {
											L19:
											_t130 = 1;
										} else {
											__eflags = _v21;
											if(_v21 == 0) {
												L18:
												_t130 = 0;
											} else {
												_t149 =  *0x6cdcc4; // 0x6d67df
												__eflags =  *_t149;
												if( *_t149 == 0) {
													goto L19;
												} else {
													goto L18;
												}
											}
										}
										_v22 = _t130;
										_push(_t206);
										_push(0x6b93c5);
										_push( *[fs:eax]);
										 *[fs:eax] = _t207;
										_t134 = ( *(_v16 + 2) & 0x0000ffff) - 0x53;
										__eflags = _t134;
										if(_t134 == 0) {
											_push(_v22 & 0x000000ff);
											E00624E78(0, _t157, _v20, 1, _t202, _t204, _t216);
										} else {
											_t139 = _t134 - 1;
											__eflags = _t139;
											if(_t139 == 0) {
												__eflags = 0;
												E006255F0(0, _t157, _v20, _t204, 0, _t216);
											} else {
												_t142 = _t139 - 0x1f;
												__eflags = _t142;
												if(_t142 == 0) {
													_push(_v22 & 0x000000ff);
													E00624E78(0, _t157, _v20, 0, _t202, _t204, _t216);
												} else {
													__eflags = _t142 - 1;
													if(__eflags == 0) {
														E0062460C(_v20, _t157, _t204);
													}
												}
											}
										}
										_pop(_t199);
										 *[fs:eax] = _t199;
									}
								}
							}
						}
						_pop(_t196);
						 *[fs:eax] = _t196;
						_push(E006B9457);
						return E00408444(_v32);
					}
				}
			}




































                                                                                          0x006b9138
                                                                                          0x006b9138
                                                                                          0x006b9138
                                                                                          0x006b9139
                                                                                          0x006b913b
                                                                                          0x006b9140
                                                                                          0x006b9140
                                                                                          0x006b9142
                                                                                          0x006b9144
                                                                                          0x006b9144
                                                                                          0x006b9147
                                                                                          0x006b9149
                                                                                          0x006b914a
                                                                                          0x006b9152
                                                                                          0x006b9153
                                                                                          0x006b9158
                                                                                          0x006b915b
                                                                                          0x006b9166
                                                                                          0x006b9173
                                                                                          0x006b9178
                                                                                          0x006b917a
                                                                                          0x006b918a
                                                                                          0x006b919c
                                                                                          0x006b919e
                                                                                          0x006b94d5
                                                                                          0x006b94d7
                                                                                          0x006b94da
                                                                                          0x006b94dd
                                                                                          0x006b94ea
                                                                                          0x006b94fc
                                                                                          0x006b91a4
                                                                                          0x006b91a4
                                                                                          0x00000000
                                                                                          0x006b91a4
                                                                                          0x006b917c
                                                                                          0x006b917c
                                                                                          0x006b91a8
                                                                                          0x006b91af
                                                                                          0x006b91bf
                                                                                          0x006b91c4
                                                                                          0x006b91d7
                                                                                          0x006b91e5
                                                                                          0x006b91ee
                                                                                          0x006b91f0
                                                                                          0x006b91f2
                                                                                          0x006b920b
                                                                                          0x006b91f0
                                                                                          0x006b921b
                                                                                          0x006b9222
                                                                                          0x006b9223
                                                                                          0x006b9228
                                                                                          0x006b922b
                                                                                          0x006b9233
                                                                                          0x006b9243
                                                                                          0x006b924d
                                                                                          0x006b925d
                                                                                          0x006b926c
                                                                                          0x006b9474
                                                                                          0x006b947c
                                                                                          0x006b9483
                                                                                          0x006b9489
                                                                                          0x006b948c
                                                                                          0x006b948f
                                                                                          0x006b9496
                                                                                          0x006b9499
                                                                                          0x006b94aa
                                                                                          0x006b94ad
                                                                                          0x006b94b0
                                                                                          0x006b94b5
                                                                                          0x006b94b9
                                                                                          0x006b94bf
                                                                                          0x00000000
                                                                                          0x006b94c8
                                                                                          0x006b94cd
                                                                                          0x006b9272
                                                                                          0x006b9279
                                                                                          0x006b927e
                                                                                          0x006b928a
                                                                                          0x006b928f
                                                                                          0x006b9295
                                                                                          0x006b929d
                                                                                          0x006b92a4
                                                                                          0x006b92a5
                                                                                          0x006b92aa
                                                                                          0x006b92ad
                                                                                          0x006b92b0
                                                                                          0x006b92ca
                                                                                          0x006b92cf
                                                                                          0x006b92d0
                                                                                          0x006b92d5
                                                                                          0x006b92d8
                                                                                          0x006b942a
                                                                                          0x006b92e6
                                                                                          0x006b92eb
                                                                                          0x006b92ee
                                                                                          0x006b92f0
                                                                                          0x006b92f2
                                                                                          0x006b92f2
                                                                                          0x006b92f5
                                                                                          0x006b92f5
                                                                                          0x006b92f7
                                                                                          0x006b92fa
                                                                                          0x006b9303
                                                                                          0x006b9307
                                                                                          0x006b9310
                                                                                          0x006b9315
                                                                                          0x006b932c
                                                                                          0x006b9331
                                                                                          0x006b9334
                                                                                          0x006b9339
                                                                                          0x006b934f
                                                                                          0x006b934f
                                                                                          0x006b933b
                                                                                          0x006b933b
                                                                                          0x006b933f
                                                                                          0x006b934b
                                                                                          0x006b934b
                                                                                          0x006b9341
                                                                                          0x006b9341
                                                                                          0x006b9346
                                                                                          0x006b9349
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006b9349
                                                                                          0x006b933f
                                                                                          0x006b9351
                                                                                          0x006b9356
                                                                                          0x006b9357
                                                                                          0x006b935c
                                                                                          0x006b935f
                                                                                          0x006b9369
                                                                                          0x006b9369
                                                                                          0x006b936d
                                                                                          0x006b9398
                                                                                          0x006b93a0
                                                                                          0x006b936f
                                                                                          0x006b936f
                                                                                          0x006b936f
                                                                                          0x006b9372
                                                                                          0x006b93b4
                                                                                          0x006b93b6
                                                                                          0x006b9374
                                                                                          0x006b9374
                                                                                          0x006b9374
                                                                                          0x006b9378
                                                                                          0x006b9385
                                                                                          0x006b938d
                                                                                          0x006b937a
                                                                                          0x006b937a
                                                                                          0x006b937d
                                                                                          0x006b93aa
                                                                                          0x006b93aa
                                                                                          0x006b937d
                                                                                          0x006b9378
                                                                                          0x006b9372
                                                                                          0x006b93bd
                                                                                          0x006b93c0
                                                                                          0x006b93c0
                                                                                          0x006b9315
                                                                                          0x006b9307
                                                                                          0x006b92fa
                                                                                          0x006b943c
                                                                                          0x006b943f
                                                                                          0x006b9442
                                                                                          0x006b944f
                                                                                          0x006b944f
                                                                                          0x006b926c

                                                                                          APIs
                                                                                          • ShowWindow.USER32(?,00000005,00000000,006B94FD,?,?,00000000,?,00000000,00000000,?,006B99DE,00000000,006B99E8,?,00000000), ref: 006B91BF
                                                                                          • ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B94FD,?,?,00000000,?,00000000,00000000), ref: 006B91E5
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 006B9206
                                                                                          • ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B94FD,?,?,00000000,?,00000000), ref: 006B921B
                                                                                            • Part of subcall function 005C6FB0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005C7045,?,?,?,00000001,?,0061037E,00000000,006103E9), ref: 005C6FE5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ShowWindow$FileModuleMultipleNameObjectsWait
                                                                                          • String ID: (\m$.lst$.msg$/REG$/REGU$<`m$Inno-Setup-RegSvr-Mutex$Setup
                                                                                          • API String ID: 66301061-906243933
                                                                                          • Opcode ID: d712a0f5838a67d77195bd4bd753ac8e6d904405e8e7bc85419a1f9c399810a1
                                                                                          • Instruction ID: 4d26cb6eac5053f9cdac576eea358071a92945d2d4b93ba07426bed60c59251a
                                                                                          • Opcode Fuzzy Hash: d712a0f5838a67d77195bd4bd753ac8e6d904405e8e7bc85419a1f9c399810a1
                                                                                          • Instruction Fuzzy Hash: 9B91D5B0A042059FDB10EBA4D856FEEBBF6FB49304F514469F600A7381DA79AD81CB74
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00629850 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 214COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 85%
                                                                                          			E00629850(char __eax, void* __ebx, signed char __edx, void* __edi, void* __esi, void* __fp0, char _a4, char _a8, intOrPtr _a12) {
				char _v5;
				char _v6;
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v60;
				void* __ecx;
				char _t65;
				void* _t69;
				void* _t112;
				signed char _t135;
				intOrPtr _t137;
				intOrPtr _t164;
				intOrPtr _t178;
				void* _t188;
				signed int _t189;
				char _t191;
				intOrPtr _t193;
				intOrPtr _t194;

				_t210 = __fp0;
				_t187 = __edi;
				_t193 = _t194;
				_t137 = 6;
				do {
					_push(0);
					_push(0);
					_t137 = _t137 - 1;
				} while (_t137 != 0);
				_push(_t137);
				_t1 =  &_v8;
				_t138 =  *_t1;
				 *_t1 = _t137;
				_push(__edi);
				_v5 =  *_t1;
				_t135 = __edx;
				_t191 = __eax;
				_push(_t193);
				_push(0x629b12);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				_v6 = 1;
				E005C53D0(__eax,  &_v12);
				if(E00422368(_v12,  *_t1, L".hlp") != 0) {
					E005C53D0(_t191,  &_v24);
					_t65 = E00422368(_v24, _t138, L".chm");
					__eflags = _t65;
					if(_t65 == 0) {
						E005C4F90(_t191, _t135,  &_v28, L".chw", __edi, _t191);
						__eflags = 0;
						E00629850(_v28, _t135, _t135, __edi, _t191, __fp0, 0, 0, _a12);
						_pop(_t138);
					}
				} else {
					E005C4F90(_t191, _t135,  &_v16, L".gid", __edi, _t191);
					E00629850(_v16, _t135, _t135, __edi, _t191, __fp0, 0, 0, _a12);
					E005C4F90(_t191, _t135,  &_v20, L".fts", __edi, _t191);
					E00629850(_v20, _t135, _t135, _t187, _t191, __fp0, 0, 0, _a12);
					_pop(_t138);
				}
				E005C53D0(_t191,  &_v32);
				_t69 = E00422368(_v32, _t138, L".lnk");
				_t197 = _t69;
				if(_t69 == 0) {
					E00624924(_t191, _t135);
				}
				if(E0060C5F4(_t135, _t191, _t197) == 0) {
					L25:
					_pop(_t164);
					 *[fs:eax] = _t164;
					_push(E00629B19);
					E0040A228( &_v60, 5);
					return E0040A228( &_v32, 6);
				} else {
					_v40 = _t191;
					_v36 = 0x11;
					_t141 = 0;
					E006163B4(L"Deleting file: %s", _t135, 0,  &_v40, _t187, _t191);
					_t199 = _a4;
					if(_a4 != 0) {
						_t189 = E0060C330(_t135, _t191, _t199);
						if(_t189 != 0xffffffff) {
							_t201 = _t189 & 0x00000001;
							if((_t189 & 0x00000001) != 0) {
								_t141 = 0xfffffffe & _t189;
								_t112 = E0060C6DC(_t135, 0xfffffffe & _t189, _t191, _t201);
								_t202 = _t112;
								if(_t112 == 0) {
									E00616130(L"Failed to strip read-only attribute.", _t135, _t189, _t191);
								} else {
									E00616130(L"Stripped read-only attribute.", _t135, _t189, _t191);
								}
							}
						}
					}
					if(E0060C158(_t135, _t191, _t202) != 0) {
						__eflags = _v5;
						if(_v5 != 0) {
							SHChangeNotify(4, 5, E0040B278(_t191), 0);
							E005C5378(_t191, _t141,  &_v60);
							E00610640( *((intOrPtr*)(_a12 - 0x3c)), _t141, _v60, _t210);
						}
						goto L25;
					} else {
						_t188 = GetLastError();
						if(_a8 == 0 ||  *((char*)(_a12 - 0x29)) == 0) {
							L22:
							_v40 = _t188;
							_v36 = 0;
							E006163B4(L"Failed to delete the file; it may be in use (%d).", _t135, 0,  &_v40, _t188, _t191);
							_v6 = 0;
							goto L25;
						} else {
							if(_t188 == 5) {
								L20:
								if((E0060C330(_t135, _t191, _t207) & 0x00000001) != 0) {
									goto L22;
								}
								_v40 = _t188;
								_v36 = 0;
								E006163B4(L"The file appears to be in use (%d). Will delete on restart.", _t135, 0,  &_v40, _t188, _t191);
								_push(_t193);
								 *[fs:eax] = _t194;
								E0060D8B0(_t135, _t135, _t191, _t188, _t191);
								 *((char*)( *((intOrPtr*)(_a12 - 0x30)) + 0x1c)) = 1;
								E005C52C8(_t191,  &_v48, _t193,  *[fs:eax]);
								E005C5378(_v48, 0,  &_v44);
								E00610640( *((intOrPtr*)(_a12 + (_t135 & 0x000000ff) * 4 - 0x38)), _a12, _v44, _t210);
								_t178 = 0x629a6d;
								 *[fs:eax] = _t178;
								goto L25;
							}
							_t207 = _t188 - 0x20;
							if(_t188 != 0x20) {
								goto L22;
							}
							goto L20;
						}
					}
				}
			}






























                                                                                          0x00629850
                                                                                          0x00629850
                                                                                          0x00629851
                                                                                          0x00629854
                                                                                          0x00629859
                                                                                          0x00629859
                                                                                          0x0062985b
                                                                                          0x0062985d
                                                                                          0x0062985d
                                                                                          0x00629860
                                                                                          0x00629861
                                                                                          0x00629861
                                                                                          0x00629861
                                                                                          0x00629866
                                                                                          0x00629867
                                                                                          0x0062986a
                                                                                          0x0062986c
                                                                                          0x00629870
                                                                                          0x00629871
                                                                                          0x00629876
                                                                                          0x00629879
                                                                                          0x0062987c
                                                                                          0x00629885
                                                                                          0x00629899
                                                                                          0x006298ea
                                                                                          0x006298f7
                                                                                          0x006298fc
                                                                                          0x006298fe
                                                                                          0x00629912
                                                                                          0x0062991a
                                                                                          0x0062991e
                                                                                          0x00629923
                                                                                          0x00629923
                                                                                          0x0062989b
                                                                                          0x006298ad
                                                                                          0x006298b9
                                                                                          0x006298d1
                                                                                          0x006298dd
                                                                                          0x006298e2
                                                                                          0x006298e2
                                                                                          0x00629929
                                                                                          0x00629936
                                                                                          0x0062993b
                                                                                          0x0062993d
                                                                                          0x00629941
                                                                                          0x00629941
                                                                                          0x00629951
                                                                                          0x00629aea
                                                                                          0x00629aec
                                                                                          0x00629aef
                                                                                          0x00629af2
                                                                                          0x00629aff
                                                                                          0x00629b11
                                                                                          0x00629957
                                                                                          0x00629957
                                                                                          0x0062995a
                                                                                          0x00629961
                                                                                          0x00629968
                                                                                          0x0062996d
                                                                                          0x00629971
                                                                                          0x0062997c
                                                                                          0x00629981
                                                                                          0x00629983
                                                                                          0x00629989
                                                                                          0x00629990
                                                                                          0x00629996
                                                                                          0x0062999b
                                                                                          0x0062999d
                                                                                          0x006299b0
                                                                                          0x0062999f
                                                                                          0x006299a4
                                                                                          0x006299a4
                                                                                          0x0062999d
                                                                                          0x00629989
                                                                                          0x00629981
                                                                                          0x006299c0
                                                                                          0x00629ab9
                                                                                          0x00629abd
                                                                                          0x00629acd
                                                                                          0x00629ad7
                                                                                          0x00629ae5
                                                                                          0x00629ae5
                                                                                          0x00000000
                                                                                          0x006299c6
                                                                                          0x006299cb
                                                                                          0x006299d1
                                                                                          0x00629a9d
                                                                                          0x00629a9d
                                                                                          0x00629aa0
                                                                                          0x00629aae
                                                                                          0x00629ab3
                                                                                          0x00000000
                                                                                          0x006299e4
                                                                                          0x006299e7
                                                                                          0x006299f2
                                                                                          0x006299fd
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00629a03
                                                                                          0x00629a06
                                                                                          0x00629a14
                                                                                          0x00629a1b
                                                                                          0x00629a24
                                                                                          0x00629a2d
                                                                                          0x00629a38
                                                                                          0x00629a41
                                                                                          0x00629a4c
                                                                                          0x00629a5e
                                                                                          0x00629a65
                                                                                          0x00629a68
                                                                                          0x00000000
                                                                                          0x00629a68
                                                                                          0x006299e9
                                                                                          0x006299ec
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006299ec
                                                                                          0x006299d1
                                                                                          0x006299c0

                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,00629B12,?,?,?,?,00000005,00000000,00000000,?,?,0062AF86,00000000,00000000,?,00000000), ref: 006299C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
                                                                                          • API String ID: 1452528299-3112430753
                                                                                          • Opcode ID: 8355013f156c967275e355fdde49d3bfd36c889115f44b6d77da2c1799e58462
                                                                                          • Instruction ID: 80e8b6ab9e5d3a552657306fa088f7fa642ecff14c11c84625059ee943e1d250
                                                                                          • Opcode Fuzzy Hash: 8355013f156c967275e355fdde49d3bfd36c889115f44b6d77da2c1799e58462
                                                                                          • Instruction Fuzzy Hash: D371E330B00B245FDB04EF68E851BEE77A6AF89710F14842DF801A7381DAB89D45CB79
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060E4D8 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 253registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 73%
                                                                                          			E0060E4D8(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _v12;
				char _v13;
				void* _v20;
				char _v21;
				char _v28;
				int _v32;
				int _v36;
				char _v40;
				char _v44;
				char* _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char* _v72;
				char _v76;
				char _v80;
				void* _t77;
				char _t98;
				char _t103;
				char* _t110;
				char _t133;
				char _t139;
				char _t144;
				void* _t168;
				short* _t169;
				char _t170;
				char _t172;
				intOrPtr _t189;
				intOrPtr _t194;
				intOrPtr _t196;
				void* _t207;
				void* _t208;
				intOrPtr _t209;

				_t207 = _t208;
				_t209 = _t208 + 0xffffffb4;
				_push(__esi);
				_push(__edi);
				_v40 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v80 = 0;
				_v56 = 0;
				_v8 = 0;
				_v12 = __edx;
				_push(_t207);
				_push(0x60e7be);
				_push( *[fs:edx]);
				 *[fs:edx] = _t209;
				_v13 = 0;
				_t168 = E005C7A14(_t77, L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v20, 3, 0);
				if(_t168 == 2) {
					L30:
					_pop(_t189);
					 *[fs:eax] = _t189;
					_push(E0060E7C5);
					E0040A228( &_v80, 2);
					E0040A228( &_v60, 2);
					E0040A228( &_v44, 2);
					return E0040A1C8( &_v8);
				} else {
					if(_t168 != 0) {
						E0060CF98(0x80000002,  &_v56, _t207);
						_v52 = _v56;
						_v48 = L"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
						E005CD4D8(0x52, 1,  &_v52,  &_v44);
						_push(_v44);
						_push(L"\r\n\r\n");
						_v72 = L"RegOpenKeyEx";
						E00423004(_t168,  &_v76);
						_v68 = _v76;
						E005C857C(_t168,  &_v80);
						_v64 = _v80;
						E005CD4D8(0x48, 2,  &_v72,  &_v60);
						_push(_v60);
						E0040B550( &_v40, _t168, 3, __edi, __esi);
						E00429008(_v40, 1);
						E004098C4();
					}
					_push(_t207);
					_push(0x60e77a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t209;
					_t169 = E0040B278(_v12);
					if(RegQueryValueExW(_v20, _t169, 0,  &_v32, 0,  &_v36) == 0) {
						_v21 = 0;
						_v28 = 0;
						_push(_t207);
						_push(0x60e6b8);
						_push( *[fs:eax]);
						 *[fs:eax] = _t209;
						_t98 = _v32 - 1;
						__eflags = _t98;
						if(_t98 == 0) {
							__eflags = E005C793C();
							if(__eflags != 0) {
								_v28 = E0042339C(_v8, __eflags);
								_v21 = 1;
							}
						} else {
							_t133 = _t98 - 2;
							__eflags = _t133;
							if(_t133 == 0) {
								__eflags = _v36 - 1;
								if(_v36 >= 1) {
									__eflags = _v36 - 4;
									if(_v36 <= 4) {
										_t139 = RegQueryValueExW(_v20, E0040B278(_v12), 0, 0,  &_v28,  &_v36);
										__eflags = _t139;
										if(_t139 == 0) {
											_v21 = 1;
										}
									}
								}
							} else {
								__eflags = _t133 == 1;
								if(_t133 == 1) {
									_v36 = 4;
									_t144 = RegQueryValueExW(_v20, _t169, 0, 0,  &_v28,  &_v36);
									__eflags = _t144;
									if(_t144 == 0) {
										_v21 = 1;
									}
								}
							}
						}
						_pop(_t194);
						 *[fs:eax] = _t194;
						__eflags = _v21;
						if(_v21 != 0) {
							_v28 = _v28 - 1;
							__eflags = _v28;
							if(_v28 > 0) {
								_t103 = _v32 - 1;
								__eflags = _t103;
								if(_t103 == 0) {
									E0042302C( &_v8, _v28, 0);
									_t170 = _v8;
									__eflags = _t170;
									if(_t170 != 0) {
										_t172 = _t170 - 4;
										__eflags = _t172;
										_t170 =  *_t172;
									}
									_t110 = E0040B278(_v8);
									RegSetValueExW(_v20, E0040B278(_v12), 0, 1, _t110, _t170 + 1 + _t170 + 1);
								} else {
									__eflags = _t103 + 0xfffffffe - 2;
									if(_t103 + 0xfffffffe - 2 < 0) {
										RegSetValueExW(_v20, E0040B278(_v12), 0, _v32,  &_v28, 4);
									}
								}
							} else {
								_v13 = 1;
								RegDeleteValueW(_v20, E0040B278(_v12));
							}
							__eflags = 0;
							_pop(_t196);
							 *[fs:eax] = _t196;
							_push(E0060E781);
							return RegCloseKey(_v20);
						} else {
							E004099B8();
							goto L30;
						}
					} else {
						E004099B8();
						goto L30;
					}
				}
			}







































                                                                                          0x0060e4d9
                                                                                          0x0060e4db
                                                                                          0x0060e4df
                                                                                          0x0060e4e0
                                                                                          0x0060e4e3
                                                                                          0x0060e4e6
                                                                                          0x0060e4e9
                                                                                          0x0060e4ec
                                                                                          0x0060e4ef
                                                                                          0x0060e4f2
                                                                                          0x0060e4f5
                                                                                          0x0060e4f8
                                                                                          0x0060e4fd
                                                                                          0x0060e4fe
                                                                                          0x0060e503
                                                                                          0x0060e506
                                                                                          0x0060e509
                                                                                          0x0060e524
                                                                                          0x0060e529
                                                                                          0x0060e781
                                                                                          0x0060e783
                                                                                          0x0060e786
                                                                                          0x0060e789
                                                                                          0x0060e796
                                                                                          0x0060e7a3
                                                                                          0x0060e7b0
                                                                                          0x0060e7bd
                                                                                          0x0060e52f
                                                                                          0x0060e531
                                                                                          0x0060e543
                                                                                          0x0060e54b
                                                                                          0x0060e553
                                                                                          0x0060e562
                                                                                          0x0060e567
                                                                                          0x0060e56a
                                                                                          0x0060e578
                                                                                          0x0060e580
                                                                                          0x0060e588
                                                                                          0x0060e590
                                                                                          0x0060e598
                                                                                          0x0060e5a7
                                                                                          0x0060e5ac
                                                                                          0x0060e5b7
                                                                                          0x0060e5c6
                                                                                          0x0060e5cb
                                                                                          0x0060e5cb
                                                                                          0x0060e5d2
                                                                                          0x0060e5d3
                                                                                          0x0060e5d8
                                                                                          0x0060e5db
                                                                                          0x0060e5f2
                                                                                          0x0060e600
                                                                                          0x0060e60c
                                                                                          0x0060e612
                                                                                          0x0060e617
                                                                                          0x0060e618
                                                                                          0x0060e61d
                                                                                          0x0060e620
                                                                                          0x0060e626
                                                                                          0x0060e626
                                                                                          0x0060e627
                                                                                          0x0060e640
                                                                                          0x0060e642
                                                                                          0x0060e64c
                                                                                          0x0060e64f
                                                                                          0x0060e64f
                                                                                          0x0060e629
                                                                                          0x0060e629
                                                                                          0x0060e629
                                                                                          0x0060e62c
                                                                                          0x0060e655
                                                                                          0x0060e659
                                                                                          0x0060e65b
                                                                                          0x0060e65f
                                                                                          0x0060e67a
                                                                                          0x0060e67f
                                                                                          0x0060e681
                                                                                          0x0060e683
                                                                                          0x0060e683
                                                                                          0x0060e681
                                                                                          0x0060e65f
                                                                                          0x0060e62e
                                                                                          0x0060e62e
                                                                                          0x0060e62f
                                                                                          0x0060e689
                                                                                          0x0060e6a1
                                                                                          0x0060e6a6
                                                                                          0x0060e6a8
                                                                                          0x0060e6aa
                                                                                          0x0060e6aa
                                                                                          0x0060e6a8
                                                                                          0x0060e62f
                                                                                          0x0060e62c
                                                                                          0x0060e6b0
                                                                                          0x0060e6b3
                                                                                          0x0060e6c2
                                                                                          0x0060e6c6
                                                                                          0x0060e6d2
                                                                                          0x0060e6d5
                                                                                          0x0060e6d9
                                                                                          0x0060e6f6
                                                                                          0x0060e6f6
                                                                                          0x0060e6f7
                                                                                          0x0060e70d
                                                                                          0x0060e712
                                                                                          0x0060e715
                                                                                          0x0060e717
                                                                                          0x0060e719
                                                                                          0x0060e719
                                                                                          0x0060e71c
                                                                                          0x0060e71c
                                                                                          0x0060e727
                                                                                          0x0060e73e
                                                                                          0x0060e6f9
                                                                                          0x0060e6fc
                                                                                          0x0060e6ff
                                                                                          0x0060e75e
                                                                                          0x0060e75e
                                                                                          0x0060e6ff
                                                                                          0x0060e6db
                                                                                          0x0060e6db
                                                                                          0x0060e6ec
                                                                                          0x0060e6ec
                                                                                          0x0060e763
                                                                                          0x0060e765
                                                                                          0x0060e768
                                                                                          0x0060e76b
                                                                                          0x0060e779
                                                                                          0x0060e6c8
                                                                                          0x0060e6c8
                                                                                          0x00000000
                                                                                          0x0060e6c8
                                                                                          0x0060e602
                                                                                          0x0060e602
                                                                                          0x00000000
                                                                                          0x0060e602
                                                                                          0x0060e600

                                                                                          APIs
                                                                                            • Part of subcall function 005C7A14: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005C80EE,?,00000000,?,005C808E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C7A30
                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,0060E77A,?,?,00000003,00000000,00000000,0060E7BE), ref: 0060E5F9
                                                                                            • Part of subcall function 005C857C: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005CBEAE,00000000,005CBEFF,?,005CC0E0), ref: 005C859B
                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,0060E6B8,?,?,00000000,00000000,?,00000000,?,00000000), ref: 0060E67A
                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,0060E6B8,?,?,00000000,00000000,?,00000000,?,00000000), ref: 0060E6A1
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0060E54E
                                                                                          • , xrefs: 0060E56A
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0060E515
                                                                                          • RegOpenKeyEx, xrefs: 0060E573
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue$FormatMessageOpen
                                                                                          • String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                          • API String ID: 2812809588-1577016196
                                                                                          • Opcode ID: 0c2d930879f7d995b89392de95c110da268bbc24b757770434c933ef14756552
                                                                                          • Instruction ID: f3c5cbb3acae1969306396449b745ae43344fa58bfe099d55e14c7ecbf00227c
                                                                                          • Opcode Fuzzy Hash: 0c2d930879f7d995b89392de95c110da268bbc24b757770434c933ef14756552
                                                                                          • Instruction Fuzzy Hash: C7919270E84219AFDB04DFA5D885BEFBBBAEB48304F14482AF500E72C1D7769945CB64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0062709C Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 162registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 84%
                                                                                          			E0062709C(signed int __eax, void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _v5;
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* __ecx;
				void* _t79;
				signed int _t83;
				signed char _t125;
				intOrPtr _t127;
				intOrPtr _t156;
				signed int _t170;
				intOrPtr _t178;
				intOrPtr _t180;
				intOrPtr _t181;

				_t180 = _t181;
				_t127 = 4;
				do {
					_push(0);
					_push(0);
					_t127 = _t127 - 1;
				} while (_t127 != 0);
				_t1 =  &_v8;
				_t128 =  *_t1;
				 *_t1 = _t127;
				_t178 =  *_t1;
				_v5 = __edx;
				_t125 = __eax;
				_push(_t180);
				_push(0x6272a5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t181;
				if( *((intOrPtr*)(0x6d6380 + ((__eax & 0x000000ff) + (__eax & 0x000000ff)) * 8 + (_v5 & 0x000000ff) * 4)) != 0) {
					L18:
					E0040A5A8(_t178,  *((intOrPtr*)(0x6d6380 + ((_t125 & 0x000000ff) + (_t125 & 0x000000ff)) * 8 + (_v5 & 0x000000ff) * 4)));
					_pop(_t156);
					 *[fs:eax] = _t156;
					_push(E006272AC);
					return E0040A228( &_v32, 5);
				}
				E00626F48(__eax, _t128,  &_v16, _t180);
				if((_v5 & 0x000000ff) + 0xfe - 2 >= 0 || E005C7A14(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v4.0", 0x80000002,  &_v12, 1, 0) != 0) {
					_t79 = (_v5 & 0x000000ff) - 1;
					if(_t79 == 0 || _t79 == 2) {
						if(E005C7A14(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0", 0x80000002,  &_v12, 1, 0) != 0) {
							goto L10;
						} else {
							_t174 = _t125 & 0x0000007f;
							E005C4EA4( *((intOrPtr*)(0x6d6374 + (_t125 & 0x0000007f) * 4)),  &_v24);
							E0040B4C8(0x6d6380 + (_t174 + _t174) * 8 + (_v5 & 0x000000ff) * 4, L"v2.0.50727", _v24);
							RegCloseKey(_v12);
							goto L14;
						}
					} else {
						L10:
						_t83 = _v5 & 0x000000ff;
						if(_t83 == 0 || _t83 == 3) {
							if(E005C7A14(_t125, L"SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v1.1", 0x80000002,  &_v12, 1, 0) == 0) {
								_t172 = _t125 & 0x0000007f;
								E005C4EA4( *((intOrPtr*)(0x6d6374 + (_t125 & 0x0000007f) * 4)),  &_v28);
								E0040B4C8(0x6d6380 + (_t172 + _t172) * 8 + (_v5 & 0x000000ff) * 4, L"v1.1.4322", _v28);
								RegCloseKey(_v12);
							}
						}
						goto L14;
					}
				} else {
					_t176 = _t125 & 0x0000007f;
					E005C4EA4( *((intOrPtr*)(0x6d6374 + (_t125 & 0x0000007f) * 4)),  &_v20);
					E0040B4C8(0x6d6380 + (_t176 + _t176) * 8 + (_v5 & 0x000000ff) * 4, L"v4.0.30319", _v20);
					RegCloseKey(_v12);
					L14:
					_t170 = _v5 & 0x000000ff;
					if( *((intOrPtr*)(0x6d6380 + ((_t125 & 0x000000ff) + (_t125 & 0x000000ff)) * 8 + _t170 * 4)) == 0) {
						if(_v5 == 3) {
							E0060CD28(L".NET Framework not found", _t125);
						} else {
							_v40 =  *((intOrPtr*)(0x6cd0a4 + _t170 * 4));
							_v36 = 0x11;
							E004244F8(L".NET Framework version %s not found", 0,  &_v40,  &_v32);
							E0060CD28(_v32, _t125);
						}
					}
					goto L18;
				}
			}























                                                                                          0x0062709d
                                                                                          0x006270a0
                                                                                          0x006270a5
                                                                                          0x006270a5
                                                                                          0x006270a7
                                                                                          0x006270a9
                                                                                          0x006270a9
                                                                                          0x006270ac
                                                                                          0x006270ac
                                                                                          0x006270ac
                                                                                          0x006270b2
                                                                                          0x006270b4
                                                                                          0x006270b7
                                                                                          0x006270bb
                                                                                          0x006270bc
                                                                                          0x006270c1
                                                                                          0x006270c4
                                                                                          0x006270db
                                                                                          0x00627270
                                                                                          0x00627285
                                                                                          0x0062728c
                                                                                          0x0062728f
                                                                                          0x00627292
                                                                                          0x006272a4
                                                                                          0x006272a4
                                                                                          0x006270e6
                                                                                          0x006270f3
                                                                                          0x00627157
                                                                                          0x00627159
                                                                                          0x0062717a
                                                                                          0x00000000
                                                                                          0x0062717c
                                                                                          0x00627181
                                                                                          0x0062718b
                                                                                          0x006271aa
                                                                                          0x006271b3
                                                                                          0x00000000
                                                                                          0x006271b3
                                                                                          0x006271ba
                                                                                          0x006271ba
                                                                                          0x006271ba
                                                                                          0x006271c0
                                                                                          0x006271e1
                                                                                          0x006271e8
                                                                                          0x006271f2
                                                                                          0x00627211
                                                                                          0x0062721a
                                                                                          0x0062721a
                                                                                          0x006271e1
                                                                                          0x00000000
                                                                                          0x006271c0
                                                                                          0x00627112
                                                                                          0x00627117
                                                                                          0x00627121
                                                                                          0x00627140
                                                                                          0x00627149
                                                                                          0x0062721f
                                                                                          0x0062721f
                                                                                          0x00627233
                                                                                          0x00627239
                                                                                          0x0062726b
                                                                                          0x0062723b
                                                                                          0x00627246
                                                                                          0x00627249
                                                                                          0x00627257
                                                                                          0x0062725f
                                                                                          0x0062725f
                                                                                          0x00627239
                                                                                          0x00000000
                                                                                          0x00627233

                                                                                          APIs
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,006272A5,?,00626DA0,?,00000000,00000000,00000000,?,?,00627510,00000000), ref: 00627149
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,006272A5,?,00626DA0,?,00000000,00000000,00000000,?,?,00627510,00000000), ref: 006271B3
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,00000001,00000000,00000000,006272A5,?,00626DA0,?,00000000,00000000,00000000,?), ref: 0062721A
                                                                                          Strings
                                                                                          • v1.1.4322, xrefs: 0062720C
                                                                                          • v4.0.30319, xrefs: 0062713B
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 006271D0
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00627169
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 006270FF
                                                                                          • .NET Framework not found, xrefs: 00627266
                                                                                          • .NET Framework version %s not found, xrefs: 00627252
                                                                                          • v2.0.50727, xrefs: 006271A5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close
                                                                                          • String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
                                                                                          • API String ID: 3535843008-446240816
                                                                                          • Opcode ID: c36a913742a8af64ff49ca3fe477697b6f4c4fca02c8e967bd5be39bebdca550
                                                                                          • Instruction ID: 6a27bfdae97b75501bbdc0cce0dcd9b9ee0f65bcede85a7be403583e7914197f
                                                                                          • Opcode Fuzzy Hash: c36a913742a8af64ff49ca3fe477697b6f4c4fca02c8e967bd5be39bebdca550
                                                                                          • Instruction Fuzzy Hash: 8551E131A091699FCF04DBA8E861FFD7BB7EF45300F1504AAF500A7392D639AB058B21
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00625D14 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00625D14(intOrPtr __eax, void* __edx) {
				long _v12;
				long _v16;
				void* __ebx;
				void* __esi;
				void* _t44;
				void* _t50;
				intOrPtr _t51;
				DWORD* _t52;

				_t19 = __eax;
				_t52 =  &_v12;
				_t44 = __edx;
				_t51 = __eax;
				if( *((char*)(__eax + 4)) == 0) {
					L11:
					return _t19;
				}
				 *((char*)(__eax + 5)) = 1;
				_v16 =  *((intOrPtr*)(__eax + 0x10));
				_v12 = 0;
				E006163B4(L"Stopping 64-bit helper process. (PID: %u)", __edx, 0,  &_v16, _t50, __eax);
				CloseHandle( *(_t51 + 0xc));
				 *(_t51 + 0xc) = 0;
				while(WaitForSingleObject( *(_t51 + 8), 0x2710) == 0x102) {
					E00616130(L"Helper isn\'t responding; killing it.", _t44, _t50, _t51);
					TerminateProcess( *(_t51 + 8), 1);
				}
				if(GetExitCodeProcess( *(_t51 + 8), _t52) == 0) {
					E00616130(L"Helper process exited, but failed to get exit code.", _t44, _t50, _t51);
				} else {
					if( *_t52 != 0) {
						_v16 =  *_t52;
						_v12 = 0;
						E006163B4(L"Helper process exited with failure code: 0x%x", _t44, 0,  &_v16, _t50, _t51);
					} else {
						E00616130(L"Helper process exited.", _t44, _t50, _t51);
					}
				}
				CloseHandle( *(_t51 + 8));
				 *(_t51 + 8) = 0;
				_t19 = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((char*)(_t51 + 4)) = 0;
				if(_t44 == 0) {
					goto L11;
				} else {
					Sleep(0xfa);
					return 0;
				}
			}











                                                                                          0x00625d14
                                                                                          0x00625d16
                                                                                          0x00625d19
                                                                                          0x00625d1b
                                                                                          0x00625d21
                                                                                          0x00625df3
                                                                                          0x00625df3
                                                                                          0x00625df3
                                                                                          0x00625d27
                                                                                          0x00625d2e
                                                                                          0x00625d32
                                                                                          0x00625d42
                                                                                          0x00625d4b
                                                                                          0x00625d52
                                                                                          0x00625d6c
                                                                                          0x00625d5c
                                                                                          0x00625d67
                                                                                          0x00625d67
                                                                                          0x00625d8d
                                                                                          0x00625dc4
                                                                                          0x00625d8f
                                                                                          0x00625d93
                                                                                          0x00625da4
                                                                                          0x00625da8
                                                                                          0x00625db8
                                                                                          0x00625d95
                                                                                          0x00625d9a
                                                                                          0x00625d9a
                                                                                          0x00625d93
                                                                                          0x00625dcd
                                                                                          0x00625dd4
                                                                                          0x00625dd7
                                                                                          0x00625dd9
                                                                                          0x00625ddc
                                                                                          0x00625de2
                                                                                          0x00000000
                                                                                          0x00625de4
                                                                                          0x00625de9
                                                                                          0x00000000
                                                                                          0x00625de9

                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(?), ref: 00625D4B
                                                                                          • TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00625D67
                                                                                          • WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00625D75
                                                                                          • GetExitCodeProcess.KERNEL32 ref: 00625D86
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00625DCD
                                                                                          • Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00625DE9
                                                                                          Strings
                                                                                          • Helper isn't responding; killing it., xrefs: 00625D57
                                                                                          • Stopping 64-bit helper process. (PID: %u), xrefs: 00625D3D
                                                                                          • Helper process exited, but failed to get exit code., xrefs: 00625DBF
                                                                                          • Helper process exited., xrefs: 00625D95
                                                                                          • Helper process exited with failure code: 0x%x, xrefs: 00625DB3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
                                                                                          • String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
                                                                                          • API String ID: 3355656108-1243109208
                                                                                          • Opcode ID: 39883d29d795098f418b7966fdcadf6d747d73cc4ff91dfa499128bca298669b
                                                                                          • Instruction ID: d564c8b30f574b505304bc0216fad519ef2dd9895e072bde183416e8b9fa8f35
                                                                                          • Opcode Fuzzy Hash: 39883d29d795098f418b7966fdcadf6d747d73cc4ff91dfa499128bca298669b
                                                                                          • Instruction Fuzzy Hash: 9C21AF70604F50AAD330EB78E44578BBBE69F08310F048C2DB59BC7682D734E8808B5A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B740C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 145fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 68%
                                                                                          			E006B740C(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				struct HWND__* _v12;
				void* _v16;
				char _v20;
				char _v24;
				char _v28;
				struct HWND__* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				WCHAR* _t41;
				intOrPtr _t42;
				int _t44;
				intOrPtr _t48;
				intOrPtr* _t54;
				void* _t68;
				intOrPtr _t80;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t108;
				void* _t109;
				intOrPtr _t110;
				void* _t118;

				_t118 = __fp0;
				_t106 = __esi;
				_t105 = __edi;
				_t88 = __ecx;
				_t87 = __ebx;
				_t108 = _t109;
				_t110 = _t109 + 0xffffffd4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v48 = 0;
				_v44 = 0;
				_v20 = 0;
				_v8 = 0;
				_push(_t108);
				_push(0x6b75fa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t110;
				E005C75E4( &_v20, __ebx, __ecx, __eflags);
				if(E0060D3B4(_v20, __ebx,  &_v8, __edi, __esi) == 0) {
					_push(_t108);
					_push( *[fs:eax]);
					 *[fs:eax] = _t110;
					E0060D8B0(0, _t87, _v8, __edi, __esi);
					_pop(_t104);
					_t88 = 0x6b746f;
					 *[fs:eax] = _t104;
				}
				_t41 = E0040B278(_v8);
				_t42 =  *0x6d68d0; // 0x0
				_t44 = CopyFileW(E0040B278(_t42), _t41, 0);
				_t113 = _t44;
				if(_t44 == 0) {
					_t80 =  *0x6cded8; // 0x6d5c28
					_t11 = _t80 + 0x208; // 0x2453eec
					E006B68EC( *_t11, _t87, _t88, _t106, _t113);
				}
				SetFileAttributesW(E0040B278(_v8), 0x80);
				_t48 =  *0x6d2634; // 0x400000
				_v12 = E00414DA0(0, L"STATIC", 0, _t48, 0, 0, 0, 0, 0, 0, 0);
				 *0x6d68fc = SetWindowLongW(_v12, 0xfffffffc, E006B6AB0);
				_push(_t108);
				_push(0x6b75c3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t110;
				_t54 =  *0x6cdec4; // 0x6d579c
				SetWindowPos( *( *_t54 + 0x188), 0, 0, 0, 0, 0, 0x97);
				E005C6FB0(0, _t87,  &_v44, _t105, _t106);
				_v40 = _v44;
				_v36 = 0x11;
				_v32 = _v12;
				_v28 = 0;
				E004244F8(L"/SECONDPHASE=\"%s\" /FIRSTPHASEWND=$%x ", 1,  &_v40,  &_v24);
				_push( &_v24);
				E005C6E90( &_v48, _t87, _t106, 0);
				_pop(_t68);
				E0040B470(_t68, _v48);
				_v16 = E006B6998(_v8, _t87, _v24, _t105, _t106, _t118);
				do {
				} while (E006B6A74() == 0 && MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0x4ff) == 1);
				CloseHandle(_v16);
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(E006B75CA);
				return DestroyWindow(_v12);
			}



























                                                                                          0x006b740c
                                                                                          0x006b740c
                                                                                          0x006b740c
                                                                                          0x006b740c
                                                                                          0x006b740c
                                                                                          0x006b740d
                                                                                          0x006b740f
                                                                                          0x006b7412
                                                                                          0x006b7413
                                                                                          0x006b7414
                                                                                          0x006b7417
                                                                                          0x006b741a
                                                                                          0x006b741d
                                                                                          0x006b7420
                                                                                          0x006b7423
                                                                                          0x006b7428
                                                                                          0x006b7429
                                                                                          0x006b742e
                                                                                          0x006b7431
                                                                                          0x006b7437
                                                                                          0x006b7449
                                                                                          0x006b744d
                                                                                          0x006b7453
                                                                                          0x006b7456
                                                                                          0x006b7460
                                                                                          0x006b7467
                                                                                          0x006b7469
                                                                                          0x006b746a
                                                                                          0x006b746a
                                                                                          0x006b747e
                                                                                          0x006b7484
                                                                                          0x006b748f
                                                                                          0x006b7494
                                                                                          0x006b7496
                                                                                          0x006b7498
                                                                                          0x006b749d
                                                                                          0x006b74a3
                                                                                          0x006b74a3
                                                                                          0x006b74b6
                                                                                          0x006b74c9
                                                                                          0x006b74e2
                                                                                          0x006b74f5
                                                                                          0x006b74fc
                                                                                          0x006b74fd
                                                                                          0x006b7502
                                                                                          0x006b7505
                                                                                          0x006b7517
                                                                                          0x006b7525
                                                                                          0x006b7533
                                                                                          0x006b753b
                                                                                          0x006b753e
                                                                                          0x006b7545
                                                                                          0x006b7548
                                                                                          0x006b7559
                                                                                          0x006b7561
                                                                                          0x006b7565
                                                                                          0x006b756d
                                                                                          0x006b756e
                                                                                          0x006b757e
                                                                                          0x006b7581
                                                                                          0x006b7586
                                                                                          0x006b75a7
                                                                                          0x006b75ae
                                                                                          0x006b75b1
                                                                                          0x006b75b4
                                                                                          0x006b75c2

                                                                                          APIs
                                                                                            • Part of subcall function 0060D3B4: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060D4F1), ref: 0060D4A1
                                                                                            • Part of subcall function 0060D3B4: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060D4F1), ref: 0060D4B1
                                                                                          • CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,006B75FA), ref: 006B748F
                                                                                          • SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,006B75FA), ref: 006B74B6
                                                                                          • SetWindowLongW.USER32(?,000000FC,006B6AB0), ref: 006B74F0
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B75C3,?,?,000000FC,006B6AB0,00000000,00400000,00000000), ref: 006B7525
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 006B7599
                                                                                          • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B75C3,?,?,000000FC,006B6AB0,00000000), ref: 006B75A7
                                                                                            • Part of subcall function 0060D8B0: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0060D996
                                                                                          • DestroyWindow.USER32(?,006B75CA,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B75C3,?,?,000000FC,006B6AB0,00000000,00400000), ref: 006B75BD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
                                                                                          • String ID: (\m$/SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
                                                                                          • API String ID: 1779715363-1630723103
                                                                                          • Opcode ID: d94475b28b27deaeafb3444f2f2e3cbc597d01184ae17fa17ce832939a113589
                                                                                          • Instruction ID: ef81c38150d0c0f6437f901880bd06975f11695bff6d213fe2789ed19ae6d402
                                                                                          • Opcode Fuzzy Hash: d94475b28b27deaeafb3444f2f2e3cbc597d01184ae17fa17ce832939a113589
                                                                                          • Instruction Fuzzy Hash: EE4181B1A04208AFDB00EFB5DC56EDE7BF9EB89314F11456AF500F7291DB789A408B64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B8BCC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 27%
                                                                                          			E005B8BCC(intOrPtr __eax, void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __edi, void* __esi, int _a4) {
				intOrPtr _v8;
				WCHAR* _v12;
				int _v16;
				struct HWND__* _v20;
				struct HMONITOR__* _v24;
				struct HWND__* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				struct tagMONITORINFO _v76;
				struct tagRECT _v92;
				struct HMONITOR__* _t49;
				struct HWND__* _t51;
				long _t68;
				intOrPtr _t79;
				struct HWND__* _t85;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t96;
				intOrPtr _t99;
				intOrPtr _t100;
				signed int _t102;
				signed int _t103;
				intOrPtr _t105;
				signed int _t107;
				signed int _t108;
				WCHAR* _t111;
				int _t113;
				void* _t115;
				void* _t116;
				intOrPtr _t117;

				_t115 = _t116;
				_t117 = _t116 + 0xffffffa8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = __ecx;
				_t111 = __edx;
				_v8 = __eax;
				_t113 = _a4;
				_v20 = E005BA14C(_v8, __ecx);
				if(_v20 != 0) {
					_t85 = _v20;
				} else {
					_t85 =  *(_v8 + 0x188);
				}
				_push(2);
				_t49 = _v20;
				_push(_t49);
				L004FBD1C();
				_v24 = _t49;
				_push(2);
				_t51 =  *(_v8 + 0x188);
				_push(_t51);
				L004FBD1C();
				_v28 = _t51;
				if(_v24 != _v28) {
					_v76.cbSize = 0x28;
					GetMonitorInfoW(_v24,  &_v76);
					GetWindowRect( *(_v8 + 0x188),  &_v92);
					_push(0x1d);
					_push(0);
					_push(0);
					_t105 = _v68;
					_t95 = _v60 - _t105;
					_t96 = _t95 >> 1;
					if(_t95 < 0) {
						asm("adc ecx, 0x0");
					}
					_push(_t96 + _t105);
					_t79 = _v76.rcMonitor;
					_t107 = _v64 - _t79;
					_t108 = _t107 >> 1;
					if(_t107 < 0) {
						asm("adc edx, 0x0");
					}
					SetWindowPos( *(_v8 + 0x188), 0, _t108 + _t79, ??, ??, ??, ??);
				}
				_v36 = E005ABB4C(_v20, _t85, _t111, _t113);
				_v32 = E005AB9A0();
				if(E005B7300(_v8) != 0) {
					_t113 = _t113 | 0x00100000;
				}
				_push(_t115);
				_push(0x5b8d37);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t117;
				_v16 = MessageBoxW(_t85, _t111, _v12, _t113);
				_pop(_t99);
				 *[fs:eax] = _t99;
				_push(E005B8D3E);
				if(_v24 != _v28) {
					_push(0x1d);
					_push(0);
					_push(0);
					_t100 = _v92.top;
					_t91 = _v92.bottom - _t100;
					_t92 = _t91 >> 1;
					if(_t91 < 0) {
						asm("adc ecx, 0x0");
					}
					_push(_t92 + _t100);
					_t68 = _v92.left;
					_t102 = _v92.right - _t68;
					_t103 = _t102 >> 1;
					if(_t102 < 0) {
						asm("adc edx, 0x0");
					}
					SetWindowPos( *(_v8 + 0x188), 0, _t103 + _t68, ??, ??, ??, ??);
				}
				E005ABC0C(_v36);
				SetActiveWindow(_v20);
				return E005AB9A8(_v32);
			}





































                                                                                          0x005b8bcd
                                                                                          0x005b8bcf
                                                                                          0x005b8bd2
                                                                                          0x005b8bd3
                                                                                          0x005b8bd4
                                                                                          0x005b8bd5
                                                                                          0x005b8bd8
                                                                                          0x005b8bda
                                                                                          0x005b8bdd
                                                                                          0x005b8be8
                                                                                          0x005b8bef
                                                                                          0x005b8bfc
                                                                                          0x005b8bf1
                                                                                          0x005b8bf4
                                                                                          0x005b8bf4
                                                                                          0x005b8bff
                                                                                          0x005b8c01
                                                                                          0x005b8c04
                                                                                          0x005b8c05
                                                                                          0x005b8c0a
                                                                                          0x005b8c0d
                                                                                          0x005b8c12
                                                                                          0x005b8c18
                                                                                          0x005b8c19
                                                                                          0x005b8c1e
                                                                                          0x005b8c27
                                                                                          0x005b8c29
                                                                                          0x005b8c38
                                                                                          0x005b8c4b
                                                                                          0x005b8c50
                                                                                          0x005b8c52
                                                                                          0x005b8c54
                                                                                          0x005b8c59
                                                                                          0x005b8c5c
                                                                                          0x005b8c5e
                                                                                          0x005b8c60
                                                                                          0x005b8c62
                                                                                          0x005b8c62
                                                                                          0x005b8c67
                                                                                          0x005b8c6b
                                                                                          0x005b8c6e
                                                                                          0x005b8c70
                                                                                          0x005b8c72
                                                                                          0x005b8c74
                                                                                          0x005b8c74
                                                                                          0x005b8c86
                                                                                          0x005b8c86
                                                                                          0x005b8c93
                                                                                          0x005b8c9b
                                                                                          0x005b8ca8
                                                                                          0x005b8caa
                                                                                          0x005b8caa
                                                                                          0x005b8cb2
                                                                                          0x005b8cb3
                                                                                          0x005b8cb8
                                                                                          0x005b8cbb
                                                                                          0x005b8cca
                                                                                          0x005b8ccf
                                                                                          0x005b8cd2
                                                                                          0x005b8cd5
                                                                                          0x005b8ce0
                                                                                          0x005b8ce2
                                                                                          0x005b8ce4
                                                                                          0x005b8ce6
                                                                                          0x005b8ceb
                                                                                          0x005b8cee
                                                                                          0x005b8cf0
                                                                                          0x005b8cf2
                                                                                          0x005b8cf4
                                                                                          0x005b8cf4
                                                                                          0x005b8cf9
                                                                                          0x005b8cfd
                                                                                          0x005b8d00
                                                                                          0x005b8d02
                                                                                          0x005b8d04
                                                                                          0x005b8d06
                                                                                          0x005b8d06
                                                                                          0x005b8d18
                                                                                          0x005b8d18
                                                                                          0x005b8d20
                                                                                          0x005b8d29
                                                                                          0x005b8d36

                                                                                          APIs
                                                                                            • Part of subcall function 005BA14C: GetActiveWindow.USER32 ref: 005BA173
                                                                                            • Part of subcall function 005BA14C: GetLastActivePopup.USER32(?), ref: 005BA188
                                                                                          • MonitorFromWindow.USER32(00000000,00000002), ref: 005B8C05
                                                                                          • MonitorFromWindow.USER32(?,00000002), ref: 005B8C19
                                                                                          • GetMonitorInfoW.USER32 ref: 005B8C38
                                                                                          • GetWindowRect.USER32 ref: 005B8C4B
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?,00000000,00000028,?,00000002,?,?,00000000), ref: 005B8C86
                                                                                          • MessageBoxW.USER32(00000000,00000000,?,?), ref: 005B8CC5
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,005B8D3E,?,00000002,?,?,00000000), ref: 005B8D18
                                                                                            • Part of subcall function 005ABC0C: IsWindow.USER32(8B565300), ref: 005ABC1A
                                                                                            • Part of subcall function 005ABC0C: EnableWindow.USER32(8B565300,000000FF), ref: 005ABC29
                                                                                          • SetActiveWindow.USER32(00000000,005B8D3E,?,00000002,?,?,00000000), ref: 005B8D29
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveMonitor$From$EnableInfoLastMessagePopupRect
                                                                                          • String ID: (
                                                                                          • API String ID: 2800294577-3887548279
                                                                                          • Opcode ID: 1481a4605a7be60ce77a10a06c154fcb03ddd17d6a9a659ef3b0366565bce946
                                                                                          • Instruction ID: a4912e974531437df4fc188b12ab37a43c5b4a9ac1c45bb7f2f89fde7e9ad722
                                                                                          • Opcode Fuzzy Hash: 1481a4605a7be60ce77a10a06c154fcb03ddd17d6a9a659ef3b0366565bce946
                                                                                          • Instruction Fuzzy Hash: 8441FDB5E00109AFDB04DBA8C895FFEBBB9FB88300F554469F500AB395DB74AD408B54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00625FC4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124pipeCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 55%
                                                                                          			E00625FC4(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __fp0, char _a4) {
				intOrPtr _v8;
				long _v12;
				void* _v16;
				struct _OVERLAPPED _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				long _t83;
				intOrPtr _t94;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t99 = _t100;
				_t101 = _t100 + 0xffffffd8;
				_v40 = 0;
				_v44 = 0;
				_v8 = __eax;
				_push(_t99);
				_push(0x626202);
				_push( *[fs:eax]);
				 *[fs:eax] = _t101;
				 *(_v8 + 0x14) =  *(_v8 + 0x14) + 1;
				 *(_v8 + 0x20) =  *(_v8 + 0x14);
				 *((intOrPtr*)(_v8 + 0x24)) = __edx;
				 *((intOrPtr*)(_v8 + 0x28)) = __ecx;
				_t83 = 0xc + __ecx;
				_push(_t99);
				_push(0x6261a7);
				_push( *[fs:edx]);
				 *[fs:edx] = _t101;
				_v16 = CreateEventW(0, 0xffffffff, 0, 0);
				if(_v16 == 0) {
					E0060CE84(L"CreateEvent");
				}
				_push(_t99);
				_push(0x62613c);
				_push( *[fs:edx]);
				 *[fs:edx] = _t101;
				E00407760( &_v36, 0x14);
				_v36.hEvent = _v16;
				if(TransactNamedPipe( *(_v8 + 0xc), _v8 + 0x20, _t83, _v8 + 0x4034, 0x14,  &_v12,  &_v36) != 0) {
					_pop(_t94);
					 *[fs:eax] = _t94;
					_push(E00626143);
					return CloseHandle(_v16);
				} else {
					if(GetLastError() != 0x3e5) {
						E0060CE84(L"TransactNamedPipe");
					}
					_push(_t99);
					_push(0x62610e);
					_push( *[fs:edx]);
					 *[fs:edx] = _t101;
					if(_a4 != 0 &&  *((short*)(_v8 + 0x1a)) != 0) {
						do {
							 *((intOrPtr*)(_v8 + 0x18))();
						} while (MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0x4ff) == 1);
					}
					_pop( *[fs:0x0]);
					_push(E00626115);
					GetOverlappedResult( *(_v8 + 0xc),  &_v36,  &_v12, 0xffffffff);
					return GetLastError();
				}
			}














                                                                                          0x00625fc5
                                                                                          0x00625fc7
                                                                                          0x00625fcf
                                                                                          0x00625fd2
                                                                                          0x00625fd5
                                                                                          0x00625fda
                                                                                          0x00625fdb
                                                                                          0x00625fe0
                                                                                          0x00625fe3
                                                                                          0x00625fe9
                                                                                          0x00625ff5
                                                                                          0x00625ffb
                                                                                          0x00626001
                                                                                          0x00626009
                                                                                          0x0062600d
                                                                                          0x0062600e
                                                                                          0x00626013
                                                                                          0x00626016
                                                                                          0x00626026
                                                                                          0x0062602d
                                                                                          0x00626034
                                                                                          0x00626034
                                                                                          0x0062603b
                                                                                          0x0062603c
                                                                                          0x00626041
                                                                                          0x00626044
                                                                                          0x00626051
                                                                                          0x00626059
                                                                                          0x00626085
                                                                                          0x00626127
                                                                                          0x0062612a
                                                                                          0x0062612d
                                                                                          0x0062613b
                                                                                          0x0062608b
                                                                                          0x00626095
                                                                                          0x0062609c
                                                                                          0x0062609c
                                                                                          0x006260a3
                                                                                          0x006260a4
                                                                                          0x006260a9
                                                                                          0x006260ac
                                                                                          0x006260b3
                                                                                          0x006260bf
                                                                                          0x006260c5
                                                                                          0x006260dc
                                                                                          0x006260bf
                                                                                          0x006260e1
                                                                                          0x006260eb
                                                                                          0x00626101
                                                                                          0x0062610d
                                                                                          0x0062610d

                                                                                          APIs
                                                                                          • CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,006261A7,?,00000000,00626202,?,?,02497ED0,00000000), ref: 00626021
                                                                                          • TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02497ED0,?,00000000,0062613C,?,00000000,000000FF,00000000,00000000,00000000,006261A7), ref: 0062607E
                                                                                          • GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02497ED0,?,00000000,0062613C,?,00000000,000000FF,00000000,00000000,00000000,006261A7), ref: 0062608B
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 006260D7
                                                                                          • GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,00626115,02497ED0,00000000), ref: 00626101
                                                                                          • GetLastError.KERNEL32(?,?,00000000,000000FF,00626115,02497ED0,00000000), ref: 00626108
                                                                                            • Part of subcall function 0060CE84: GetLastError.KERNEL32(00000000,0060DBAA,00000005,00000000,0060DBD2,?,?,006D579C,?,00000000,00000000,00000000,?,006B910F,00000000,006B912A), ref: 0060CE87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
                                                                                          • String ID: CreateEvent$TransactNamedPipe
                                                                                          • API String ID: 2182916169-3012584893
                                                                                          • Opcode ID: a06eff76c2156a534d1e4dc483291fabc8641127e113913af401bd78cfb4e81c
                                                                                          • Instruction ID: 6106728f610c95dcbec9252819f2c5c1e9fccb50d9899b4423df3e52f48f78ac
                                                                                          • Opcode Fuzzy Hash: a06eff76c2156a534d1e4dc483291fabc8641127e113913af401bd78cfb4e81c
                                                                                          • Instruction Fuzzy Hash: 6441AC70A00618EFDB05DF99DD85EDEBBBAEB08310F1041A9F904E7392D674AE50CB24
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040DF90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E0040DF90(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t18;
				signed short _t28;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t47;

				_t42 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t44 = __edx;
				_t28 = __eax;
				_push(_t47);
				_push(0x40e094);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				EnterCriticalSection(0x6d1c14);
				if(_t28 !=  *0x6d1c2c) {
					LeaveCriticalSection(0x6d1c14);
					E0040A1C8(_t44);
					if(IsValidLocale(_t28 & 0x0000ffff, 2) != 0) {
						if( *0x6d1c10 == 0) {
							_t18 = E0040DC78(_t28, _t28, _t44, __edi, _t44);
							L00405254();
							if(_t28 != _t18) {
								if( *_t44 != 0) {
									_t18 = E0040B470(_t44, E0040E0AC);
								}
								L00405254();
								E0040DC78(_t18, _t28,  &_v8, _t42, _t44);
								E0040B470(_t44, _v8);
							}
						} else {
							E0040DE74(_t28, _t44);
						}
					}
					EnterCriticalSection(0x6d1c14);
					 *0x6d1c2c = _t28;
					E0040DAF8(0x6d1c2e, E0040B278( *_t44), 0xaa);
					LeaveCriticalSection(0x6d1c14);
				} else {
					E0040B318(_t44, 0x55, 0x6d1c2e);
					LeaveCriticalSection(0x6d1c14);
				}
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E0040E09B);
				return E0040A1C8( &_v8);
			}









                                                                                          0x0040df90
                                                                                          0x0040df93
                                                                                          0x0040df95
                                                                                          0x0040df96
                                                                                          0x0040df97
                                                                                          0x0040df99
                                                                                          0x0040df9d
                                                                                          0x0040df9e
                                                                                          0x0040dfa3
                                                                                          0x0040dfa6
                                                                                          0x0040dfae
                                                                                          0x0040dfba
                                                                                          0x0040dfe1
                                                                                          0x0040dfe8
                                                                                          0x0040dffa
                                                                                          0x0040e003
                                                                                          0x0040e014
                                                                                          0x0040e019
                                                                                          0x0040e021
                                                                                          0x0040e026
                                                                                          0x0040e02f
                                                                                          0x0040e02f
                                                                                          0x0040e034
                                                                                          0x0040e03c
                                                                                          0x0040e046
                                                                                          0x0040e046
                                                                                          0x0040e005
                                                                                          0x0040e009
                                                                                          0x0040e009
                                                                                          0x0040e003
                                                                                          0x0040e050
                                                                                          0x0040e055
                                                                                          0x0040e06f
                                                                                          0x0040e079
                                                                                          0x0040dfbc
                                                                                          0x0040dfc8
                                                                                          0x0040dfd2
                                                                                          0x0040dfd2
                                                                                          0x0040e080
                                                                                          0x0040e083
                                                                                          0x0040e086
                                                                                          0x0040e093

                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000,00000000), ref: 0040DFAE
                                                                                          • LeaveCriticalSection.KERNEL32(006D1C14,006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000), ref: 0040DFD2
                                                                                          • LeaveCriticalSection.KERNEL32(006D1C14,006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000), ref: 0040DFE1
                                                                                          • IsValidLocale.KERNEL32(00000000,00000002,006D1C14,006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040DFF3
                                                                                          • EnterCriticalSection.KERNEL32(006D1C14,00000000,00000002,006D1C14,006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040E050
                                                                                          • LeaveCriticalSection.KERNEL32(006D1C14,006D1C14,00000000,00000002,006D1C14,006D1C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040E079
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Leave$Enter$LocaleValid
                                                                                          • String ID: en-US,en,
                                                                                          • API String ID: 975949045-3579323720
                                                                                          • Opcode ID: 729a0adbb78085491c5dacc51944d4462026b7fd1257d9750f2a694d76a71a5e
                                                                                          • Instruction ID: 7d1429daecdd90a797f7fba0e37e49eac4d41b909b59f49409e6443efac98480
                                                                                          • Opcode Fuzzy Hash: 729a0adbb78085491c5dacc51944d4462026b7fd1257d9750f2a694d76a71a5e
                                                                                          • Instruction Fuzzy Hash: F7218A60B90614A6DB10B7B78C0265A3245DB46708F51487BB540BF3C7CAFD8D558AAF
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00408BB4 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 63libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 40%
                                                                                          			E00408BB4(void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char* _t23;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff4;
				_v16 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_v8 = 0x40;
					goto L11;
				} else {
					_t2 =  &_v16; // 0x5c7cef
					_t23 = _t2;
					_push(_t23);
					_push(0);
					L00405324();
					if(_t23 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_t3 =  &_v16; // 0x5c7cef
						_v12 = E00406F0C( *_t3);
						_push(_t41);
						_push(E00408C62);
						_push( *[fs:edx]);
						 *[fs:edx] = _t44;
						_t5 =  &_v16; // 0x5c7cef
						_push(_v12);
						L00405324();
						_t29 = _v12;
						if(_v16 <= 0) {
							L8:
							_pop(_t39);
							 *[fs:eax] = _t39;
							_push(E00408C69);
							return L00406F28(_v12);
						} else {
							while( *((short*)(_t29 + 4)) != 2 ||  *((char*)(_t29 + 8)) != 1) {
								_t29 = _t29 + 0x18;
								_v16 = _v16 - 0x18;
								if(_v16 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_v8 =  *(_t29 + 0xa) & 0x0000ffff;
							E004099B8();
							L11:
							return _v8;
						}
					}
				}
				L12:
			}












                                                                                          0x00408bb5
                                                                                          0x00408bb7
                                                                                          0x00408bbc
                                                                                          0x00408bd6
                                                                                          0x00408c69
                                                                                          0x00408c69
                                                                                          0x00000000
                                                                                          0x00408bdc
                                                                                          0x00408bdc
                                                                                          0x00408bdc
                                                                                          0x00408bdf
                                                                                          0x00408be0
                                                                                          0x00408be2
                                                                                          0x00408be9
                                                                                          0x00000000
                                                                                          0x00408bf5
                                                                                          0x00408bf5
                                                                                          0x00408bfd
                                                                                          0x00408c02
                                                                                          0x00408c03
                                                                                          0x00408c08
                                                                                          0x00408c0b
                                                                                          0x00408c0e
                                                                                          0x00408c15
                                                                                          0x00408c16
                                                                                          0x00408c1b
                                                                                          0x00408c22
                                                                                          0x00408c4c
                                                                                          0x00408c4e
                                                                                          0x00408c51
                                                                                          0x00408c54
                                                                                          0x00408c61
                                                                                          0x00408c24
                                                                                          0x00408c24
                                                                                          0x00408c3f
                                                                                          0x00408c42
                                                                                          0x00408c4a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408c4a
                                                                                          0x00408c35
                                                                                          0x00408c38
                                                                                          0x00408c70
                                                                                          0x00408c76
                                                                                          0x00408c76
                                                                                          0x00408c22
                                                                                          0x00408be9
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00408BC9
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408BCF
                                                                                          • GetLogicalProcessorInformation.KERNEL32(00000000,|\,GetLogicalProcessorInformation), ref: 00408BE2
                                                                                          • GetLastError.KERNEL32(00000000,|\,GetLogicalProcessorInformation), ref: 00408BEB
                                                                                          • GetLogicalProcessorInformation.KERNEL32(00000000,|\,00000000,00408C62,?,00000000,|\,GetLogicalProcessorInformation), ref: 00408C16
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
                                                                                          • String ID: @$GetLogicalProcessorInformation$kernel32.dll$|\
                                                                                          • API String ID: 1184211438-1747287015
                                                                                          • Opcode ID: 6e2ada3f67621efaaa4b523dae5d47507039bff2cdd35c870d17f18bdfe38c68
                                                                                          • Instruction ID: fae384035c4cbf403bb6e842233c038de7d928fc1d1ef8a2a4529768a9174d83
                                                                                          • Opcode Fuzzy Hash: 6e2ada3f67621efaaa4b523dae5d47507039bff2cdd35c870d17f18bdfe38c68
                                                                                          • Instruction Fuzzy Hash: E4117570D05208AEEF10EBA5DA45A6EB7F4DB44704F1084BFE454B72C1DF7D8A548B29
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00624704 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 25%
                                                                                          			E00624704(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr _t33;
				intOrPtr* _t37;
				intOrPtr* _t49;
				intOrPtr _t61;
				intOrPtr* _t66;
				void* _t68;
				intOrPtr _t70;
				intOrPtr _t71;

				_t70 = _t71;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t68 = __eax;
				_push(_t70);
				_push(0x62481e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t71;
				_t66 = E00414020(__ebx, _t68, GetModuleHandleW(L"OLEAUT32.DLL"), L"UnRegisterTypeLib");
				_t49 = _t66;
				if(_t66 == 0) {
					E0060CE84(L"GetProcAddress");
				}
				E005C52C8(_t68,  &_v20, _t70);
				E0040B368( &_v8, _v20);
				_push(E0040EC28( &_v12));
				_t28 = E0040AEF4(_v8);
				_push(_t28);
				L0043C244();
				if(_t28 != 0) {
					E0060CE98(L"LoadTypeLib", _t49, _t28, _t68);
				}
				_push( &_v16);
				_t30 = _v12;
				_push(_t30);
				if( *((intOrPtr*)( *_t30 + 0x1c))() != 0) {
					E0060CE98(L"ITypeLib::GetLibAttr", _t49, _t32, _t68);
				}
				_push(_t70);
				_push(0x6247f1);
				_push( *[fs:edx]);
				 *[fs:edx] = _t71;
				_t33 = _v16;
				_push( *((intOrPtr*)(_t33 + 0x14)));
				_push( *((intOrPtr*)(_t33 + 0x10)));
				_push( *(_t33 + 0x1a) & 0x0000ffff);
				_push( *(_t33 + 0x18) & 0x0000ffff);
				_push(_t33);
				if( *_t49() != 0) {
					E0060CE98(L"UnRegisterTypeLib", _t49, _t34, _t68);
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_t37 = _v12;
				return  *((intOrPtr*)( *_t37 + 0x30))(_t37, _v16, E006247F8);
			}

















                                                                                          0x00624705
                                                                                          0x00624709
                                                                                          0x0062470a
                                                                                          0x0062470b
                                                                                          0x0062470c
                                                                                          0x0062470d
                                                                                          0x0062470e
                                                                                          0x00624710
                                                                                          0x00624714
                                                                                          0x00624715
                                                                                          0x0062471a
                                                                                          0x0062471d
                                                                                          0x00624735
                                                                                          0x00624737
                                                                                          0x0062473b
                                                                                          0x00624742
                                                                                          0x00624742
                                                                                          0x0062474c
                                                                                          0x00624757
                                                                                          0x00624764
                                                                                          0x00624768
                                                                                          0x0062476d
                                                                                          0x0062476e
                                                                                          0x00624775
                                                                                          0x0062477e
                                                                                          0x0062477e
                                                                                          0x00624786
                                                                                          0x00624787
                                                                                          0x0062478a
                                                                                          0x00624792
                                                                                          0x0062479b
                                                                                          0x0062479b
                                                                                          0x006247a2
                                                                                          0x006247a3
                                                                                          0x006247a8
                                                                                          0x006247ab
                                                                                          0x006247ae
                                                                                          0x006247b4
                                                                                          0x006247b8
                                                                                          0x006247bd
                                                                                          0x006247c2
                                                                                          0x006247c3
                                                                                          0x006247c8
                                                                                          0x006247d1
                                                                                          0x006247d1
                                                                                          0x006247d8
                                                                                          0x006247db
                                                                                          0x006247e7
                                                                                          0x006247f0

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,0062481E,?,?,?,00000000,00000000,00000000,00000000,00000000,?,0062A1C5,00000000,0062A1D9), ref: 0062472A
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0062476E
                                                                                            • Part of subcall function 0060CE84: GetLastError.KERNEL32(00000000,0060DBAA,00000005,00000000,0060DBD2,?,?,006D579C,?,00000000,00000000,00000000,?,006B910F,00000000,006B912A), ref: 0060CE87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressErrorHandleLastLoadModuleProcType
                                                                                          • String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
                                                                                          • API String ID: 1914119943-2711329623
                                                                                          • Opcode ID: 2e05f23e5f76792d1f5a7b80f8ec6988081919b038bf5ab4b7eec07067a5f530
                                                                                          • Instruction ID: 47cd072b4b06506b06a7a0fd2e311c11a36de303591e536be68bff5c72022a6e
                                                                                          • Opcode Fuzzy Hash: 2e05f23e5f76792d1f5a7b80f8ec6988081919b038bf5ab4b7eec07067a5f530
                                                                                          • Instruction Fuzzy Hash: 19219171610A146FDB14EFA9EC42D6B77EEEF897407124469F410D3291EF78EC008B64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C7FF4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 61%
                                                                                          			E005C7FF4(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x5c80ee);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E00414020(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					if(E00429D18() != 2) {
						if(E005C7A14(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E005C793C();
							RegCloseKey(_v12);
						}
					} else {
						if(E005C7A14(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E005C793C();
							RegCloseKey(_v12);
						}
					}
					E0040B4C8( &_v20, _v8, 0x5c8204);
					E00407870(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E005C80F5);
				E0040A1C8( &_v20);
				return E0040A1C8( &_v8);
			}










                                                                                          0x005c7ffa
                                                                                          0x005c7ffd
                                                                                          0x005c8000
                                                                                          0x005c8005
                                                                                          0x005c8006
                                                                                          0x005c800b
                                                                                          0x005c800e
                                                                                          0x005c8021
                                                                                          0x005c8028
                                                                                          0x005c803b
                                                                                          0x005c8090
                                                                                          0x005c809d
                                                                                          0x005c80a6
                                                                                          0x005c80a6
                                                                                          0x005c803d
                                                                                          0x005c8058
                                                                                          0x005c8065
                                                                                          0x005c806e
                                                                                          0x005c806e
                                                                                          0x005c8058
                                                                                          0x005c80b6
                                                                                          0x005c80c1
                                                                                          0x005c80cc
                                                                                          0x005c80cc
                                                                                          0x005c802a
                                                                                          0x005c802a
                                                                                          0x005c802c
                                                                                          0x005c80d2
                                                                                          0x005c80d5
                                                                                          0x005c80d8
                                                                                          0x005c80e0
                                                                                          0x005c80ed

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C801B
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          • RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C806E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressCloseHandleModuleProc
                                                                                          • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
                                                                                          • API String ID: 4190037839-2401316094
                                                                                          • Opcode ID: 470556889dcc2c08780527d259b89145f8e901b6fec06280ed5c6bcc4663caab
                                                                                          • Instruction ID: b59d3067a1cffae51886ca0dc1f1740e66d40653876fb7099798d5cffc045aa9
                                                                                          • Opcode Fuzzy Hash: 470556889dcc2c08780527d259b89145f8e901b6fec06280ed5c6bcc4663caab
                                                                                          • Instruction Fuzzy Hash: 51214F34A04209AFDB10EAE5CC5AFFE7BE9FB48704F60486DA500F3681EE74AA45C755
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00624BA8 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E00624BA8(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v13;
				char _v84;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				void* _t58;
				void* _t91;
				char _t92;
				intOrPtr _t110;
				void* _t120;
				void* _t123;

				_t118 = __edi;
				_v116 = 0;
				_v120 = 0;
				_v112 = 0;
				_v108 = 0;
				_v104 = 0;
				_v8 = 0;
				_v12 = 0;
				_t120 = __ecx;
				_t91 = __edx;
				_v13 = __eax;
				_push(_t123);
				_push(0x624d3e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t123 + 0xffffff84;
				E005C745C( &_v8);
				_push(0x624d58);
				E005C4EA4(_v8,  &_v104);
				_push(_v104);
				_push(L"regsvr32.exe\"");
				E0040B550( &_v12, _t91, 3, __edi, _t120);
				if(_v13 != 0) {
					E0040B470( &_v12, 0x624d90);
				}
				_push(_v12);
				_push(L" /s \"");
				_push(_t120);
				_push(0x624d58);
				E0040B550( &_v12, _t91, 4, _t118, _t120);
				_t126 = _t91;
				if(_t91 == 0) {
					E0040B4C8( &_v112, _v12, L"Spawning 32-bit RegSvr32: ");
					E00616130(_v112, _t91, _t118, _t120);
				} else {
					E0040B4C8( &_v108, _v12, L"Spawning 64-bit RegSvr32: ");
					E00616130(_v108, _t91, _t118, _t120);
				}
				E00407760( &_v84, 0x44);
				_v84 = 0x44;
				_t58 = E0040B278(_v8);
				if(E0060C038(_t91, E0040B278(_v12), 0, _t126,  &_v100,  &_v84, _t58, 0, 0x4000000, 0, 0, 0) == 0) {
					E0060CE84(L"CreateProcess");
				}
				CloseHandle(_v96);
				_t92 = E00624AA4( &_v100);
				if(_t92 != 0) {
					_v128 = _t92;
					_v124 = 0;
					E004244F8(L"0x%x", 0,  &_v128,  &_v120);
					E005CD508(0x53,  &_v116, _v120);
					E00429008(_v116, 1);
					E004098C4();
				}
				_pop(_t110);
				 *[fs:eax] = _t110;
				_push(E00624D45);
				E0040A228( &_v120, 5);
				return E0040A228( &_v12, 2);
			}






















                                                                                          0x00624ba8
                                                                                          0x00624bb2
                                                                                          0x00624bb5
                                                                                          0x00624bb8
                                                                                          0x00624bbb
                                                                                          0x00624bbe
                                                                                          0x00624bc1
                                                                                          0x00624bc4
                                                                                          0x00624bc7
                                                                                          0x00624bc9
                                                                                          0x00624bcb
                                                                                          0x00624bd0
                                                                                          0x00624bd1
                                                                                          0x00624bd6
                                                                                          0x00624bd9
                                                                                          0x00624bdf
                                                                                          0x00624be4
                                                                                          0x00624bef
                                                                                          0x00624bf4
                                                                                          0x00624bf7
                                                                                          0x00624c04
                                                                                          0x00624c0d
                                                                                          0x00624c17
                                                                                          0x00624c17
                                                                                          0x00624c1c
                                                                                          0x00624c1f
                                                                                          0x00624c24
                                                                                          0x00624c25
                                                                                          0x00624c32
                                                                                          0x00624c37
                                                                                          0x00624c39
                                                                                          0x00624c60
                                                                                          0x00624c68
                                                                                          0x00624c3b
                                                                                          0x00624c46
                                                                                          0x00624c4e
                                                                                          0x00624c4e
                                                                                          0x00624c77
                                                                                          0x00624c7c
                                                                                          0x00624c93
                                                                                          0x00624cb6
                                                                                          0x00624cbd
                                                                                          0x00624cbd
                                                                                          0x00624cc6
                                                                                          0x00624cd3
                                                                                          0x00624cd7
                                                                                          0x00624cdd
                                                                                          0x00624ce0
                                                                                          0x00624cee
                                                                                          0x00624cfd
                                                                                          0x00624d0c
                                                                                          0x00624d11
                                                                                          0x00624d11
                                                                                          0x00624d18
                                                                                          0x00624d1b
                                                                                          0x00624d1e
                                                                                          0x00624d2b
                                                                                          0x00624d3d

                                                                                          APIs
                                                                                            • Part of subcall function 005C745C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C746F
                                                                                          • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00624D58,?, /s ",006D579C,regsvr32.exe",?,00624D58), ref: 00624CC6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseDirectoryHandleSystem
                                                                                          • String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
                                                                                          • API String ID: 2051275411-1862435767
                                                                                          • Opcode ID: e8098db1f6129802545a0ccc7cd3f2f5306fa3516f88ec2ab7c397c10dfb52a1
                                                                                          • Instruction ID: 4609d961d1e6a6c9b50d20a9c17260b7e2f4bf46ee5c2bafd069b1c5a14d41a0
                                                                                          • Opcode Fuzzy Hash: e8098db1f6129802545a0ccc7cd3f2f5306fa3516f88ec2ab7c397c10dfb52a1
                                                                                          • Instruction Fuzzy Hash: 0B413F30A0061CABDB10EFE5D892ACDBBBAFF48304F51457EA504B7282DB746A05CF59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004062CC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 72%
                                                                                          			E004062CC(int __eax, void* __ecx, void* __edx) {
				long _v12;
				int _t4;
				long _t7;
				void* _t11;
				long _t12;
				void* _t13;
				long _t18;

				_t4 = __eax;
				_t24 = __edx;
				_t20 = __eax;
				if( *0x6cf05c == 0) {
					_push(0x2010);
					_push(__edx);
					_push(__eax);
					_push(0);
					L0040529C();
				} else {
					_t7 = E0040A6C4(__edx);
					WriteFile(GetStdHandle(0xfffffff4), _t24, _t7,  &_v12, 0);
					_t11 =  *0x6c507c; // 0x40543c
					_t12 = E0040A6C4(_t11);
					_t13 =  *0x6c507c; // 0x40543c
					WriteFile(GetStdHandle(0xfffffff4), _t13, _t12,  &_v12, 0);
					_t18 = E0040A6C4(_t20);
					_t4 = WriteFile(GetStdHandle(0xfffffff4), _t20, _t18,  &_v12, 0);
				}
				return _t4;
			}










                                                                                          0x004062cc
                                                                                          0x004062cf
                                                                                          0x004062d1
                                                                                          0x004062da
                                                                                          0x0040633d
                                                                                          0x00406342
                                                                                          0x00406343
                                                                                          0x00406344
                                                                                          0x00406346
                                                                                          0x004062dc
                                                                                          0x004062e5
                                                                                          0x004062f4
                                                                                          0x00406300
                                                                                          0x00406305
                                                                                          0x0040630b
                                                                                          0x00406319
                                                                                          0x00406327
                                                                                          0x00406336
                                                                                          0x00406336
                                                                                          0x0040634e

                                                                                          APIs
                                                                                          • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 004062EE
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 004062F4
                                                                                          • GetStdHandle.KERNEL32(000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406313
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406319
                                                                                          • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 00406330
                                                                                          • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 00406336
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite
                                                                                          • String ID: <T@
                                                                                          • API String ID: 3320372497-2050694182
                                                                                          • Opcode ID: 7428f3ca4e97fc00497157dc5da428094fbc857927b6e69d6d862abc9904a002
                                                                                          • Instruction ID: ee5667e1a227ecbea5375e2fa2ea65b47cf69c4a4a195d8f09788a9c4629ec5a
                                                                                          • Opcode Fuzzy Hash: 7428f3ca4e97fc00497157dc5da428094fbc857927b6e69d6d862abc9904a002
                                                                                          • Instruction Fuzzy Hash: 5701A9A16046147DE610F3BA9C4AF6B279CCB0976CF10463B7514F61D2C97C9C548B7E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405D88 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 91%
                                                                                          			E00405D88(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x6cf05d; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00405764();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								if(VirtualFree(_t103, 0, 0x8000) == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x6d1b7c = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x6cf98d;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x6cf05d; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x6cfaec], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x6cf98d;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x6cfaec], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E004055DC(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E004055DC(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x6cfaf4 - 0x13ffe0;
							if( *0x6cfaf4 != 0x13ffe0) {
								_t53 = _t106 + 0x13ffe0; // 0x13ffe0
								_t82 = _t53;
								E0040567C(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x6cfaf4 = 0x13ffe0;
								 *0x6cfaf0 = _t82;
								 *0x6cfaec = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x6cfaec = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E0040561C(_t106, _t88, _t81);
							 *0x6cfaec = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}




























                                                                                          0x00405d88
                                                                                          0x00405d88
                                                                                          0x00405d91
                                                                                          0x00405d97
                                                                                          0x00405e80
                                                                                          0x00405e83
                                                                                          0x00405f70
                                                                                          0x00405f71
                                                                                          0x00405f74
                                                                                          0x00405814
                                                                                          0x00405816
                                                                                          0x00405818
                                                                                          0x0040581d
                                                                                          0x00405820
                                                                                          0x00405825
                                                                                          0x00405829
                                                                                          0x0040582f
                                                                                          0x00405833
                                                                                          0x00405839
                                                                                          0x00405855
                                                                                          0x00405859
                                                                                          0x0040585c
                                                                                          0x0040585c
                                                                                          0x0040585e
                                                                                          0x00405866
                                                                                          0x00405873
                                                                                          0x00405878
                                                                                          0x0040587a
                                                                                          0x0040587c
                                                                                          0x0040587f
                                                                                          0x0040587f
                                                                                          0x00405881
                                                                                          0x00405885
                                                                                          0x00405887
                                                                                          0x00405889
                                                                                          0x0040588b
                                                                                          0x00000000
                                                                                          0x0040588b
                                                                                          0x00000000
                                                                                          0x00405887
                                                                                          0x0040583b
                                                                                          0x0040584a
                                                                                          0x00405850
                                                                                          0x0040584c
                                                                                          0x0040584c
                                                                                          0x0040584c
                                                                                          0x0040584a
                                                                                          0x0040588f
                                                                                          0x00405891
                                                                                          0x0040589a
                                                                                          0x004058a3
                                                                                          0x004058a3
                                                                                          0x004058a6
                                                                                          0x004058b6
                                                                                          0x00405f7a
                                                                                          0x00405f7f
                                                                                          0x00405f7f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405d9d
                                                                                          0x00405d9d
                                                                                          0x00405d9f
                                                                                          0x00405da1
                                                                                          0x00405e04
                                                                                          0x00405e04
                                                                                          0x00405e09
                                                                                          0x00405e0d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405e0f
                                                                                          0x00405e11
                                                                                          0x00405e18
                                                                                          0x00000000
                                                                                          0x00405e1a
                                                                                          0x00405e1e
                                                                                          0x00405e23
                                                                                          0x00405e24
                                                                                          0x00405e25
                                                                                          0x00405e2a
                                                                                          0x00405e2e
                                                                                          0x00405e38
                                                                                          0x00405e3d
                                                                                          0x00405e3e
                                                                                          0x00000000
                                                                                          0x00405e3e
                                                                                          0x00405e2e
                                                                                          0x00000000
                                                                                          0x00405e18
                                                                                          0x00405e04
                                                                                          0x00405da3
                                                                                          0x00405da3
                                                                                          0x00405da3
                                                                                          0x00405da3
                                                                                          0x00405da7
                                                                                          0x00405daa
                                                                                          0x00405dd8
                                                                                          0x00405dda
                                                                                          0x00405def
                                                                                          0x00405def
                                                                                          0x00405ddc
                                                                                          0x00405ddc
                                                                                          0x00405ddf
                                                                                          0x00405de2
                                                                                          0x00405de5
                                                                                          0x00405de8
                                                                                          0x00405dea
                                                                                          0x00405ded
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405ded
                                                                                          0x00405df2
                                                                                          0x00405df4
                                                                                          0x00405df6
                                                                                          0x00405df9
                                                                                          0x00405e89
                                                                                          0x00405e8c
                                                                                          0x00405e8e
                                                                                          0x00405e90
                                                                                          0x00405e91
                                                                                          0x00405e93
                                                                                          0x00405e44
                                                                                          0x00405e44
                                                                                          0x00405e49
                                                                                          0x00405e51
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405e53
                                                                                          0x00405e55
                                                                                          0x00405e5c
                                                                                          0x00000000
                                                                                          0x00405e5e
                                                                                          0x00405e60
                                                                                          0x00405e65
                                                                                          0x00405e6a
                                                                                          0x00405e72
                                                                                          0x00405e76
                                                                                          0x00000000
                                                                                          0x00405e76
                                                                                          0x00405e72
                                                                                          0x00000000
                                                                                          0x00405e5c
                                                                                          0x00405e44
                                                                                          0x00405e95
                                                                                          0x00405e95
                                                                                          0x00405e9d
                                                                                          0x00405ea1
                                                                                          0x00405ed8
                                                                                          0x00405edb
                                                                                          0x00405ede
                                                                                          0x00405ee0
                                                                                          0x00405ee6
                                                                                          0x00405ee8
                                                                                          0x00405ee8
                                                                                          0x00405ea3
                                                                                          0x00405ea3
                                                                                          0x00405ea3
                                                                                          0x00405ea6
                                                                                          0x00405ea6
                                                                                          0x00405eaa
                                                                                          0x00405eae
                                                                                          0x00405ef0
                                                                                          0x00405ef3
                                                                                          0x00405ef5
                                                                                          0x00405ef7
                                                                                          0x00405efd
                                                                                          0x00405f01
                                                                                          0x00405f01
                                                                                          0x00405efd
                                                                                          0x00405eb0
                                                                                          0x00405eb6
                                                                                          0x00405f08
                                                                                          0x00405f12
                                                                                          0x00405f40
                                                                                          0x00405f40
                                                                                          0x00405f46
                                                                                          0x00405f4b
                                                                                          0x00405f52
                                                                                          0x00405f5c
                                                                                          0x00405f62
                                                                                          0x00405f69
                                                                                          0x00405f6d
                                                                                          0x00405f14
                                                                                          0x00405f14
                                                                                          0x00405f17
                                                                                          0x00405f19
                                                                                          0x00405f1c
                                                                                          0x00405f1f
                                                                                          0x00405f21
                                                                                          0x00405f30
                                                                                          0x00405f35
                                                                                          0x00405f38
                                                                                          0x00405f3c
                                                                                          0x00405f3c
                                                                                          0x00405eb8
                                                                                          0x00405ebb
                                                                                          0x00405ebe
                                                                                          0x00405ec6
                                                                                          0x00405ecb
                                                                                          0x00405ed2
                                                                                          0x00405ed6
                                                                                          0x00405ed6
                                                                                          0x00405dac
                                                                                          0x00405dac
                                                                                          0x00405dae
                                                                                          0x00405db4
                                                                                          0x00405db7
                                                                                          0x00405dc0
                                                                                          0x00405dc3
                                                                                          0x00405dc6
                                                                                          0x00405dc9
                                                                                          0x00405dcc
                                                                                          0x00405dcf
                                                                                          0x00405dd2
                                                                                          0x00405dd2
                                                                                          0x00405dd4
                                                                                          0x00405dd5
                                                                                          0x00405db9
                                                                                          0x00405db9
                                                                                          0x00405db9
                                                                                          0x00405dbb
                                                                                          0x00405dbd
                                                                                          0x00405dbe
                                                                                          0x00405dbe
                                                                                          0x00405db7
                                                                                          0x00405daa

                                                                                          APIs
                                                                                          • Sleep.KERNEL32(00000000,?,00000000,024E8810,004090EA,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8,?,00429D26,005C7CEF,00000000), ref: 00405E1E
                                                                                          • Sleep.KERNEL32(0000000A,00000000,?,00000000,024E8810,004090EA,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8,?,00429D26,005C7CEF), ref: 00405E38
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: c2dfef0c243d83f632b1c8941f448a8383cc65ae3fb1c2822762f5bc8acd34d3
                                                                                          • Instruction ID: 71ad01a6e0dc675f4130d8d0918bf11407b14d9ec69c5e02b41b8aae26145368
                                                                                          • Opcode Fuzzy Hash: c2dfef0c243d83f632b1c8941f448a8383cc65ae3fb1c2822762f5bc8acd34d3
                                                                                          • Instruction Fuzzy Hash: 2871C031604A008FD715DB69C989B27BBD5EF85314F18C17FE888AB3D2D6B88941CF99
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00628E3C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E00628E3C(void* __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __eflags, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				char _v9;
				char _v16;
				char _v20;
				char _v24;
				void* _t44;
				intOrPtr _t50;
				void* _t51;
				void* _t65;
				void* _t71;
				void* _t76;
				intOrPtr _t88;
				signed int _t103;
				void* _t104;
				char _t106;
				void* _t109;
				void* _t122;

				_t122 = __fp0;
				_push(__ebx);
				_push(__esi);
				_v24 = 0;
				_v8 = __ecx;
				_t106 = __edx;
				_t76 = __eax;
				_push(_t109);
				_push(0x628fc2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t109 + 0xffffffec;
				_t103 = E0060C330(__eax, __edx, __eflags);
				if(_t103 == 0xffffffff || (_t103 & 0x00000010) == 0) {
					_v9 = 1;
					goto L18;
				} else {
					_v20 = _t106;
					_v16 = 0x11;
					E006163B4(L"Deleting directory: %s", _t76, 0,  &_v20, _t103, _t106);
					if((_t103 & 0x00000001) == 0) {
						L9:
						_t44 = E0060C664(_t76, _t106, _t117);
						asm("sbb eax, eax");
						_v9 = _t44 + 1;
						if(_v9 != 0) {
							L18:
							_pop(_t88);
							 *[fs:eax] = _t88;
							_push(E00628FC9);
							return E0040A1C8( &_v24);
						}
						_t104 = GetLastError();
						if(_v8 == 0) {
							__eflags = _a4;
							if(_a4 == 0) {
								L16:
								_v20 = _t104;
								_v16 = 0;
								E006163B4(L"Failed to delete directory (%d).", _t76, 0,  &_v20, _t104, _t106);
								goto L18;
							}
							_t50 = E00628C68(_a4, _t76, _t106, _t106);
							__eflags = _t50;
							if(_t50 == 0) {
								goto L16;
							}
							_t51 = E00429D18();
							__eflags = _t51 - 2;
							if(_t51 != 2) {
								goto L16;
							}
							_v20 = _t104;
							_v16 = 0;
							E006163B4(L"Failed to delete directory (%d). Will delete on restart (if empty).", _t76, 0,  &_v20, _t104, _t106);
							E00628D50(_t76, _t76, _t106, _t104, _t106);
							goto L18;
						}
						_v20 = _t104;
						_v16 = 0;
						E006163B4(L"Failed to delete directory (%d). Will retry later.", _t76, 0,  &_v20, _t104, _t106);
						E0040B29C();
						E0040B470( &_v24, _t106);
						E00610640(_v8, 0, _v24, _t122);
						goto L18;
					}
					_t115 = _t103 & 0x00000400;
					if((_t103 & 0x00000400) != 0) {
						L5:
						_t65 = E0060C6DC(_t76, 0xfffffffe & _t103, _t106, _t116);
						_t117 = _t65;
						if(_t65 == 0) {
							E00616130(L"Failed to strip read-only attribute.", _t76, _t103, _t106);
						} else {
							E00616130(L"Stripped read-only attribute.", _t76, _t103, _t106);
						}
						goto L9;
					}
					_t71 = E0060DFAC(_t76, _t76, _t106, _t106, _t115);
					_t116 = _t71;
					if(_t71 == 0) {
						E00616130(L"Not stripping read-only attribute because the directory does not appear to be empty.", _t76, _t103, _t106);
						goto L9;
					}
					goto L5;
				}
			}




















                                                                                          0x00628e3c
                                                                                          0x00628e42
                                                                                          0x00628e43
                                                                                          0x00628e47
                                                                                          0x00628e4a
                                                                                          0x00628e4d
                                                                                          0x00628e4f
                                                                                          0x00628e53
                                                                                          0x00628e54
                                                                                          0x00628e59
                                                                                          0x00628e5c
                                                                                          0x00628e68
                                                                                          0x00628e6d
                                                                                          0x00628fa8
                                                                                          0x00000000
                                                                                          0x00628e7f
                                                                                          0x00628e7f
                                                                                          0x00628e82
                                                                                          0x00628e90
                                                                                          0x00628e9b
                                                                                          0x00628ee8
                                                                                          0x00628eec
                                                                                          0x00628ef4
                                                                                          0x00628ef7
                                                                                          0x00628efe
                                                                                          0x00628fac
                                                                                          0x00628fae
                                                                                          0x00628fb1
                                                                                          0x00628fb4
                                                                                          0x00628fc1
                                                                                          0x00628fc1
                                                                                          0x00628f09
                                                                                          0x00628f0f
                                                                                          0x00628f51
                                                                                          0x00628f55
                                                                                          0x00628f90
                                                                                          0x00628f90
                                                                                          0x00628f93
                                                                                          0x00628fa1
                                                                                          0x00000000
                                                                                          0x00628fa1
                                                                                          0x00628f5c
                                                                                          0x00628f61
                                                                                          0x00628f63
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00628f65
                                                                                          0x00628f6a
                                                                                          0x00628f6d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00628f6f
                                                                                          0x00628f72
                                                                                          0x00628f80
                                                                                          0x00628f89
                                                                                          0x00000000
                                                                                          0x00628f89
                                                                                          0x00628f11
                                                                                          0x00628f14
                                                                                          0x00628f22
                                                                                          0x00628f35
                                                                                          0x00628f3f
                                                                                          0x00628f4a
                                                                                          0x00000000
                                                                                          0x00628f4a
                                                                                          0x00628e9d
                                                                                          0x00628ea3
                                                                                          0x00628eb2
                                                                                          0x00628ebd
                                                                                          0x00628ec2
                                                                                          0x00628ec4
                                                                                          0x00628ed7
                                                                                          0x00628ec6
                                                                                          0x00628ecb
                                                                                          0x00628ecb
                                                                                          0x00000000
                                                                                          0x00628ec4
                                                                                          0x00628ea9
                                                                                          0x00628eae
                                                                                          0x00628eb0
                                                                                          0x00628ee3
                                                                                          0x00000000
                                                                                          0x00628ee3
                                                                                          0x00000000
                                                                                          0x00628eb0

                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,00628FC2,?,00000000,?), ref: 00628F04
                                                                                            • Part of subcall function 0060DFAC: FindClose.KERNEL32(000000FF,0060E0A1), ref: 0060E090
                                                                                          Strings
                                                                                          • Failed to delete directory (%d)., xrefs: 00628F9C
                                                                                          • Deleting directory: %s, xrefs: 00628E8B
                                                                                          • Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00628F7B
                                                                                          • Failed to strip read-only attribute., xrefs: 00628ED2
                                                                                          • Stripped read-only attribute., xrefs: 00628EC6
                                                                                          • Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00628EDE
                                                                                          • Failed to delete directory (%d). Will retry later., xrefs: 00628F1D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseErrorFindLast
                                                                                          • String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
                                                                                          • API String ID: 754982922-1448842058
                                                                                          • Opcode ID: aaccf4f98e71df52330d287d42d0f6e92e9b9256fd032e63f9ec723d91b924bb
                                                                                          • Instruction ID: bb024c1df45f9af0c8d848e5c22ededdbf4d41f71593f538bf5593c1374477db
                                                                                          • Opcode Fuzzy Hash: aaccf4f98e71df52330d287d42d0f6e92e9b9256fd032e63f9ec723d91b924bb
                                                                                          • Instruction Fuzzy Hash: B5410330A11A285ECB00EB68DD053EE77E7AF84310F11842EB411D3382CFB48E45CBA6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B8390 Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005B8390(void* __eax, struct HWND__** __edx) {
				long _v20;
				intOrPtr _t17;
				intOrPtr _t30;
				void* _t46;
				void* _t50;
				struct HWND__** _t51;
				struct HWND__* _t52;
				struct HWND__* _t53;
				void* _t54;
				DWORD* _t55;

				_t55 = _t54 + 0xfffffff8;
				_t51 = __edx;
				_t50 = __eax;
				_t46 = 0;
				_t17 =  *((intOrPtr*)(__edx + 4));
				if(_t17 < 0x100 || _t17 > 0x109) {
					L19:
					return _t46;
				} else {
					_t52 = GetCapture();
					if(_t52 != 0) {
						GetWindowThreadProcessId(_t52, _t55);
						GetWindowThreadProcessId( *(_t50 + 0x188),  &_v20);
						if( *_t55 == _v20 && SendMessageW(_t52, _t51[1] + 0xbc00, _t51[2], _t51[3]) != 0) {
							_t46 = 1;
						}
						goto L19;
					}
					_t53 =  *_t51;
					_t30 =  *((intOrPtr*)(_t50 + 0x58));
					if(_t30 == 0 || _t53 !=  *((intOrPtr*)(_t30 + 0x3c4))) {
						L7:
						if(E0050E9B4(_t53) == 0 && _t53 != 0) {
							_t53 = GetParent(_t53);
							goto L7;
						}
						if(_t53 == 0) {
							_t53 =  *_t51;
						}
						goto L11;
					} else {
						_t53 = E0051B414(_t30);
						L11:
						if(IsWindowUnicode(_t53) == 0) {
							if(SendMessageA(_t53, _t51[1] + 0xbc00, _t51[2], _t51[3]) != 0) {
								_t46 = 1;
							}
						} else {
							if(SendMessageW(_t53, _t51[1] + 0xbc00, _t51[2], _t51[3]) != 0) {
								_t46 = 1;
							}
						}
						goto L19;
					}
				}
			}













                                                                                          0x005b8394
                                                                                          0x005b8397
                                                                                          0x005b8399
                                                                                          0x005b839b
                                                                                          0x005b839d
                                                                                          0x005b83a5
                                                                                          0x005b847e
                                                                                          0x005b8486
                                                                                          0x005b83b6
                                                                                          0x005b83bb
                                                                                          0x005b83bf
                                                                                          0x005b8442
                                                                                          0x005b8453
                                                                                          0x005b845f
                                                                                          0x005b847c
                                                                                          0x005b847c
                                                                                          0x00000000
                                                                                          0x005b845f
                                                                                          0x005b83c1
                                                                                          0x005b83c3
                                                                                          0x005b83c8
                                                                                          0x005b83e3
                                                                                          0x005b83ec
                                                                                          0x005b83e1
                                                                                          0x00000000
                                                                                          0x005b83e1
                                                                                          0x005b83f4
                                                                                          0x005b83f6
                                                                                          0x005b83f6
                                                                                          0x00000000
                                                                                          0x005b83d2
                                                                                          0x005b83d7
                                                                                          0x005b83f8
                                                                                          0x005b8400
                                                                                          0x005b843a
                                                                                          0x005b843c
                                                                                          0x005b843c
                                                                                          0x005b8402
                                                                                          0x005b841b
                                                                                          0x005b841d
                                                                                          0x005b841d
                                                                                          0x005b841b
                                                                                          0x00000000
                                                                                          0x005b8400
                                                                                          0x005b83c8

                                                                                          APIs
                                                                                          • GetCapture.USER32 ref: 005B83B6
                                                                                          • IsWindowUnicode.USER32(00000000), ref: 005B83F9
                                                                                          • SendMessageW.USER32(00000000,-0000BBEE,024CBDE0,?), ref: 005B8414
                                                                                          • SendMessageA.USER32 ref: 005B8433
                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 005B8442
                                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 005B8453
                                                                                          • SendMessageW.USER32(00000000,-0000BBEE,024CBDE0,?), ref: 005B8473
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSendWindow$ProcessThread$CaptureUnicode
                                                                                          • String ID:
                                                                                          • API String ID: 1994056952-0
                                                                                          • Opcode ID: 60d5d18c6536e8f3e7333ea3e87ccb02092badd8fb76314d68d3832b537e943d
                                                                                          • Instruction ID: fa2d834c3aada0f77e9407d785ac3e39b975c7e98aa55159218471e4f58a832a
                                                                                          • Opcode Fuzzy Hash: 60d5d18c6536e8f3e7333ea3e87ccb02092badd8fb76314d68d3832b537e943d
                                                                                          • Instruction Fuzzy Hash: 3C21BFB520460A6F9A60EA99CD40EE777DCFF44744B105829B999C3642DE14F840C765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405F80 Relevance: 10.9, APIs: 7, Instructions: 406COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00405F80(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t192;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t205;
				unsigned int _t207;
				intOrPtr _t213;
				void* _t225;
				intOrPtr _t227;
				void* _t228;
				signed int _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t241;
				void* _t243;
				intOrPtr* _t244;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t217 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t217);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t225);
							_t244 = _t243 + 0xffffffe0;
							_t218 = __edx;
							_t202 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00405A04(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t218 - 0x40a2c;
										if(_t218 > 0x40a2c) {
											_t78 = _t202 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t218;
										}
										E004055C0(_t202, _t218, _t150);
										E00405D88(_t202, _t202, _t225);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t227 = __edx;
								} else {
									_t227 = 0xbadb9d;
								}
								 *_t244 = _t202 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t244 + 8), _t244 + 8, 0x1c);
								if( *((intOrPtr*)(_t244 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00405A04(_t227);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t227 - 0x40a2c;
										if(_t227 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t218;
										}
										E00405590(_t202,  *((intOrPtr*)(_t202 - 0x10 + 8)), _t150);
										E00405D88(_t202, _t202, _t227);
									}
								} else {
									 *(_t244 + 0x10) =  *(_t244 + 0x10) & 0xffff0000;
									_t94 =  *(_t244 + 0x10);
									if(_t218 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t227 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t244 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t244 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t202 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t218;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t202;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t205 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t225);
						if(__edx > _t171) {
							_t102 =  *(_t205 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t228 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t207 = _t171;
								_t109 = E00405A04(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t192 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t228 - 0x40a2c;
									if(_t228 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t192;
									}
									_t230 = _t109;
									E00405590(_t217, _t207, _t109);
									E00405D88(_t217, _t207, _t230);
									return _t230;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t232 = _t171 + _t115;
								__eflags = __edx - _t232;
								if(__edx > _t232) {
									goto L75;
								} else {
									__eflags =  *0x6cf05d;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E004055DC(_t205);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t195 = _t232 + 4 - _t123;
										__eflags = _t195;
										if(_t195 > 0) {
											 *(_t217 + _t232 - 4) = _t195;
											 *((intOrPtr*)(_t217 - 4 + _t123)) = _t195 + 3;
											_t233 = _t123;
											__eflags = _t195 - 0xb30;
											if(_t195 >= 0xb30) {
												__eflags = _t123 + _t217;
												E0040561C(_t123 + _t217, _t171, _t195);
											}
										} else {
											 *(_t217 + _t232) =  *(_t217 + _t232) & 0xfffffff7;
											_t233 = _t232 + 4;
										}
										_t234 = _t233 | _t156;
										__eflags = _t234;
										 *(_t217 - 4) = _t234;
										 *0x6cfaec = 0;
										_t109 = _t217;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x6cfaec], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x6cf98d;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x6cfaec], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										_t129 =  *(_t205 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x6cfaec = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t232 = _t171 + _t115;
											__eflags = _t176 - _t232;
											if(_t176 > _t232) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t238 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t238;
									__eflags =  *0x6cf05d;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x6cfaec], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x6cf98d;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x6cfaec], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										__eflags = 0xf;
									}
									 *(_t217 - 4) = _t156 | _t238;
									_t161 = _t174;
									_t196 =  *(_t205 - 4);
									__eflags = _t196 & 0x00000001;
									if((_t196 & 0x00000001) != 0) {
										_t131 = _t205;
										_t197 = _t196 & 0xfffffff0;
										_t161 = _t161 + _t197;
										_t205 = _t205 + _t197;
										__eflags = _t197 - 0xb30;
										if(_t197 >= 0xb30) {
											E004055DC(_t131);
										}
									} else {
										 *(_t205 - 4) = _t196 | 0x00000008;
									}
									 *((intOrPtr*)(_t205 - 8)) = _t161;
									 *((intOrPtr*)(_t217 + _t238 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E0040561C(_t217 + _t238, _t174, _t161);
									}
									 *0x6cfaec = 0;
									return _t217;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t213 = __edx;
										_t140 = E00405A04(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t241 = _t140;
											E004055C0(_t217, _t213, _t140);
											E00405D88(_t217, _t213, _t241);
											_t140 = _t241;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00405A04((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E00405D88(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00405A04(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E00405D88(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}












































                                                                                          0x00405f80
                                                                                          0x00405f80
                                                                                          0x00405f80
                                                                                          0x00405f88
                                                                                          0x00405f8a
                                                                                          0x00406018
                                                                                          0x0040601b
                                                                                          0x00406288
                                                                                          0x00406289
                                                                                          0x0040628a
                                                                                          0x0040628d
                                                                                          0x004058b8
                                                                                          0x004058b9
                                                                                          0x004058ba
                                                                                          0x004058bb
                                                                                          0x004058bc
                                                                                          0x004058bf
                                                                                          0x004058c1
                                                                                          0x004058c8
                                                                                          0x004058d1
                                                                                          0x004058d6
                                                                                          0x004059bd
                                                                                          0x004059bf
                                                                                          0x004059d2
                                                                                          0x004059d4
                                                                                          0x004059d6
                                                                                          0x004059d8
                                                                                          0x004059de
                                                                                          0x004059e2
                                                                                          0x004059e2
                                                                                          0x004059e5
                                                                                          0x004059e5
                                                                                          0x004059ee
                                                                                          0x004059f5
                                                                                          0x004059f5
                                                                                          0x004059c1
                                                                                          0x004059c1
                                                                                          0x004059c6
                                                                                          0x004059c6
                                                                                          0x004058dc
                                                                                          0x004058e5
                                                                                          0x004058eb
                                                                                          0x004058e7
                                                                                          0x004058e7
                                                                                          0x004058e7
                                                                                          0x004058f7
                                                                                          0x00405906
                                                                                          0x00405913
                                                                                          0x00405983
                                                                                          0x0040598a
                                                                                          0x0040598c
                                                                                          0x0040598e
                                                                                          0x00405990
                                                                                          0x00405996
                                                                                          0x0040599a
                                                                                          0x0040599a
                                                                                          0x0040599d
                                                                                          0x0040599d
                                                                                          0x004059ad
                                                                                          0x004059b4
                                                                                          0x004059b4
                                                                                          0x00405915
                                                                                          0x00405915
                                                                                          0x00405921
                                                                                          0x00405927
                                                                                          0x00000000
                                                                                          0x00405929
                                                                                          0x0040593a
                                                                                          0x0040593e
                                                                                          0x00405940
                                                                                          0x00405940
                                                                                          0x00405956
                                                                                          0x00000000
                                                                                          0x0040596e
                                                                                          0x00405970
                                                                                          0x00405973
                                                                                          0x0040597c
                                                                                          0x0040597f
                                                                                          0x0040597f
                                                                                          0x00405956
                                                                                          0x00405927
                                                                                          0x00405913
                                                                                          0x00405a03
                                                                                          0x00406293
                                                                                          0x00406293
                                                                                          0x00406295
                                                                                          0x00406295
                                                                                          0x00406021
                                                                                          0x00406023
                                                                                          0x00406026
                                                                                          0x00406027
                                                                                          0x0040602a
                                                                                          0x0040602d
                                                                                          0x00406030
                                                                                          0x00406032
                                                                                          0x00406033
                                                                                          0x00406148
                                                                                          0x0040614b
                                                                                          0x0040614d
                                                                                          0x00406240
                                                                                          0x0040624b
                                                                                          0x00406252
                                                                                          0x00406254
                                                                                          0x00406257
                                                                                          0x0040625c
                                                                                          0x0040625d
                                                                                          0x0040625f
                                                                                          0x00000000
                                                                                          0x00406261
                                                                                          0x00406261
                                                                                          0x00406267
                                                                                          0x00406269
                                                                                          0x00406269
                                                                                          0x0040626c
                                                                                          0x00406274
                                                                                          0x0040627b
                                                                                          0x00406286
                                                                                          0x00406286
                                                                                          0x00406153
                                                                                          0x00406153
                                                                                          0x00406156
                                                                                          0x00406159
                                                                                          0x0040615b
                                                                                          0x00000000
                                                                                          0x00406161
                                                                                          0x00406161
                                                                                          0x00406168
                                                                                          0x004061c5
                                                                                          0x004061c5
                                                                                          0x004061ca
                                                                                          0x004061d0
                                                                                          0x004061d5
                                                                                          0x004061d6
                                                                                          0x004061d6
                                                                                          0x004061e2
                                                                                          0x004061f3
                                                                                          0x004061f9
                                                                                          0x004061f9
                                                                                          0x004061fb
                                                                                          0x00406208
                                                                                          0x0040620f
                                                                                          0x00406213
                                                                                          0x00406215
                                                                                          0x0040621b
                                                                                          0x0040621d
                                                                                          0x0040621f
                                                                                          0x0040621f
                                                                                          0x004061fd
                                                                                          0x004061fd
                                                                                          0x00406201
                                                                                          0x00406201
                                                                                          0x00406224
                                                                                          0x00406224
                                                                                          0x00406226
                                                                                          0x00406229
                                                                                          0x00406230
                                                                                          0x00406232
                                                                                          0x00406236
                                                                                          0x0040616a
                                                                                          0x0040616a
                                                                                          0x0040616f
                                                                                          0x00406177
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406179
                                                                                          0x0040617b
                                                                                          0x00406182
                                                                                          0x00000000
                                                                                          0x00406184
                                                                                          0x00406188
                                                                                          0x0040618d
                                                                                          0x0040618e
                                                                                          0x00406194
                                                                                          0x0040619c
                                                                                          0x004061a2
                                                                                          0x004061a7
                                                                                          0x004061a8
                                                                                          0x00000000
                                                                                          0x004061a8
                                                                                          0x0040619c
                                                                                          0x00000000
                                                                                          0x00406182
                                                                                          0x004061b1
                                                                                          0x004061b4
                                                                                          0x004061b7
                                                                                          0x004061b9
                                                                                          0x00406239
                                                                                          0x00406239
                                                                                          0x00000000
                                                                                          0x004061bb
                                                                                          0x004061bb
                                                                                          0x004061be
                                                                                          0x004061c1
                                                                                          0x004061c3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004061c3
                                                                                          0x004061b9
                                                                                          0x00406168
                                                                                          0x0040615b
                                                                                          0x00406039
                                                                                          0x0040603c
                                                                                          0x0040603e
                                                                                          0x00406048
                                                                                          0x0040604e
                                                                                          0x00406065
                                                                                          0x00406065
                                                                                          0x00406071
                                                                                          0x00406077
                                                                                          0x00406079
                                                                                          0x00406080
                                                                                          0x00406082
                                                                                          0x00406087
                                                                                          0x0040608f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406091
                                                                                          0x00406093
                                                                                          0x0040609a
                                                                                          0x00000000
                                                                                          0x0040609c
                                                                                          0x0040609f
                                                                                          0x004060a4
                                                                                          0x004060aa
                                                                                          0x004060b2
                                                                                          0x004060b7
                                                                                          0x004060bc
                                                                                          0x00000000
                                                                                          0x004060bc
                                                                                          0x004060b2
                                                                                          0x00000000
                                                                                          0x0040609a
                                                                                          0x004060c5
                                                                                          0x004060c5
                                                                                          0x004060c5
                                                                                          0x004060ca
                                                                                          0x004060cd
                                                                                          0x004060cf
                                                                                          0x004060d2
                                                                                          0x004060d5
                                                                                          0x004060e0
                                                                                          0x004060e2
                                                                                          0x004060e5
                                                                                          0x004060e7
                                                                                          0x004060e9
                                                                                          0x004060ef
                                                                                          0x004060f1
                                                                                          0x004060f1
                                                                                          0x004060d7
                                                                                          0x004060da
                                                                                          0x004060da
                                                                                          0x004060f6
                                                                                          0x004060fc
                                                                                          0x00406100
                                                                                          0x00406106
                                                                                          0x0040610d
                                                                                          0x0040610d
                                                                                          0x00406112
                                                                                          0x0040611f
                                                                                          0x00406050
                                                                                          0x00406050
                                                                                          0x00406056
                                                                                          0x00406120
                                                                                          0x00406124
                                                                                          0x00406129
                                                                                          0x0040612b
                                                                                          0x0040612d
                                                                                          0x00406135
                                                                                          0x0040613c
                                                                                          0x00406141
                                                                                          0x00406141
                                                                                          0x00406147
                                                                                          0x0040605c
                                                                                          0x0040605c
                                                                                          0x00406061
                                                                                          0x00406063
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406063
                                                                                          0x00406056
                                                                                          0x00406040
                                                                                          0x00406040
                                                                                          0x00406044
                                                                                          0x00406044
                                                                                          0x0040603e
                                                                                          0x00406033
                                                                                          0x00405f90
                                                                                          0x00405f90
                                                                                          0x00405f92
                                                                                          0x00405f96
                                                                                          0x00405f99
                                                                                          0x00405f9b
                                                                                          0x00405fd4
                                                                                          0x00405fd8
                                                                                          0x00405fd9
                                                                                          0x00405fdb
                                                                                          0x00405fdd
                                                                                          0x00405fdf
                                                                                          0x00405fe2
                                                                                          0x00405fe4
                                                                                          0x00405fe6
                                                                                          0x00405feb
                                                                                          0x00405fed
                                                                                          0x00405fef
                                                                                          0x00405ff5
                                                                                          0x00405ff7
                                                                                          0x00405ff7
                                                                                          0x00405ffe
                                                                                          0x00405ffe
                                                                                          0x00406001
                                                                                          0x00406003
                                                                                          0x0040600c
                                                                                          0x00406011
                                                                                          0x00406011
                                                                                          0x00406013
                                                                                          0x00406014
                                                                                          0x00406015
                                                                                          0x00406016
                                                                                          0x00405f9d
                                                                                          0x00405f9d
                                                                                          0x00405fa4
                                                                                          0x00405fa6
                                                                                          0x00405fac
                                                                                          0x00405fae
                                                                                          0x00405fb0
                                                                                          0x00405fb5
                                                                                          0x00405fb7
                                                                                          0x00405fb9
                                                                                          0x00405fbb
                                                                                          0x00405fbd
                                                                                          0x00405fc8
                                                                                          0x00405fcd
                                                                                          0x00405fcd
                                                                                          0x00405fcf
                                                                                          0x00405fd0
                                                                                          0x00405fd1
                                                                                          0x00405fa8
                                                                                          0x00405fa8
                                                                                          0x00405fa9
                                                                                          0x00405faa
                                                                                          0x00405faa
                                                                                          0x00405fa6
                                                                                          0x00405f9b

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b109c11200ecfbb04ea33e8116d0a4c78a9801d59ee61d8af0747204eed65d95
                                                                                          • Instruction ID: 5d66737b0d4da92f98c0db807105cf356bd4b4b1c4874a50b8b8aa415a59ee3b
                                                                                          • Opcode Fuzzy Hash: b109c11200ecfbb04ea33e8116d0a4c78a9801d59ee61d8af0747204eed65d95
                                                                                          • Instruction Fuzzy Hash: D1C134A2710A004BD714AB7D9C8476FB286DBC5324F19823FE645EB3D6DA7CCC558B88
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006158C4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 239windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 62%
                                                                                          			E006158C4(void* __ebx, int* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				int* _v16;
				char _v144;
				intOrPtr _v148;
				void* _v152;
				intOrPtr _v156;
				char _v168;
				char _v172;
				void* _t51;
				intOrPtr* _t57;
				intOrPtr* _t62;
				intOrPtr* _t65;
				intOrPtr* _t71;
				intOrPtr _t77;
				void* _t104;
				void* _t107;
				int* _t108;
				struct HWND__* _t118;
				int _t122;
				intOrPtr _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t162;
				struct HWND__* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t169;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t181;
				void* _t182;
				intOrPtr _t183;
				void* _t189;

				_t189 = __fp0;
				_t179 = __esi;
				_t178 = __edi;
				_t181 = _t182;
				_t183 = _t182 + 0xffffff58;
				_push(__esi);
				_push(__edi);
				_v172 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = __edx;
				_push(_t181);
				_push(0x615c7e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t183;
				_push(_t181);
				_push(0x615c40);
				_push( *[fs:edx]);
				 *[fs:edx] = _t183;
				_t122 =  *_v16;
				_t51 = _t122 - 0x4a;
				if(_t51 == 0) {
					_t53 = _v16[2];
					_t152 =  *(_v16[2]) - 0x800;
					__eflags = _t152;
					if(__eflags == 0) {
						_push(_t181);
						_push(0x615a6b);
						_push( *[fs:edx]);
						 *[fs:edx] = _t183;
						E0040A350( &_v8,  *(_t53 + 4) >> 1,  *((intOrPtr*)(_t53 + 8)), __eflags);
						_push(_t181);
						_push(0x615a29);
						_push( *[fs:eax]);
						 *[fs:eax] = _t183;
						_t57 =  *0x6cd8cc; // 0x6d681c
						 *_t57 =  *_t57 + 1;
						_push(_t181);
						_push(0x615a0e);
						_push( *[fs:eax]);
						 *[fs:eax] = _t183;
						L006ABD3C(_v8,  *(_t53 + 4) >> 1,  &_v12);
						_pop(_t156);
						 *[fs:eax] = _t156;
						_push(E00615A15);
						_t62 =  *0x6cd8cc; // 0x6d681c
						 *_t62 =  *_t62 - 1;
						__eflags =  *_t62;
						return _t62;
					} else {
						_t157 = _t152 - 1;
						__eflags = _t157;
						if(_t157 == 0) {
							_push(_t181);
							_push(0x615b61);
							_push( *[fs:edx]);
							 *[fs:edx] = _t183;
							E0040714C( *((intOrPtr*)(_t53 + 8)), _t122, 0x98,  &_v168);
							_push(_t181);
							_push(0x615b1f);
							_push( *[fs:eax]);
							 *[fs:eax] = _t183;
							_t65 =  *0x6cdb4c; // 0x6d682c
							__eflags =  *_t65;
							if( *_t65 == 0) {
								E00429008(L"Cannot evaluate variable because [Code] isn\'t running yet", 1);
								E004098C4();
							}
							E0040A998( &_v172, 0x80,  &_v144, 0);
							_t71 =  *0x6cdb4c; // 0x6d682c
							E006A3E88( *_t71, _t122, _v156, _t178, _t179, _t189,  &_v12, _v172, _v148);
							_v16[3] = 1;
							_pop(_t162);
							 *[fs:eax] = _t162;
							_t163 =  *0x6d62f8; // 0x0
							_t77 =  *0x6d62f4; // 0x0
							E005D6064(_t77, _t122, _t163, _t178, _t179, _v12);
							_pop(_t164);
							 *[fs:eax] = _t164;
						} else {
							_t169 = _t157 - 1;
							__eflags = _t169;
							if(_t169 == 0) {
								_push(_t181);
								_push(0x615bb7);
								_push( *[fs:edx]);
								 *[fs:edx] = _t183;
								E0040A1EC(0x6d62e8);
								E0040A3A4(0x6d62e8,  *(_v16[2] + 4) >> 0,  *((intOrPtr*)(_v16[2] + 8)), __eflags, 0);
								_v16[3] = 1;
								_pop(_t172);
								 *[fs:eax] = _t172;
							} else {
								__eflags = _t169 == 1;
								if(_t169 == 1) {
									_push(_t181);
									_push(0x615c0a);
									_push( *[fs:edx]);
									 *[fs:edx] = _t183;
									E0040A1EC(0x6d62ec);
									E0040A3A4(0x6d62ec,  *(_v16[2] + 4) >> 0,  *((intOrPtr*)(_v16[2] + 8)), __eflags, 0);
									_v16[3] = 1;
									_pop(_t176);
									 *[fs:eax] = _t176;
								}
							}
						}
						goto L21;
					}
				} else {
					_t104 = _t51 - 0xbb6;
					if(_t104 == 0) {
						 *0x6d62e4 = 0;
						 *0x6d62f4 = 0;
						 *0x6d62fc = 1;
						 *0x6d62fd = 0;
						PostMessageW(0, 0, 0, 0);
					} else {
						_t107 = _t104 - 1;
						if(_t107 == 0) {
							 *0x6d62fc = 1;
							_t108 = _v16;
							__eflags =  *((intOrPtr*)(_t108 + 4)) - 1;
							 *0x6d62fd =  *((intOrPtr*)(_t108 + 4)) == 1;
							PostMessageW(0, 0, 0, 0);
						} else {
							if(_t107 == 2) {
								SetForegroundWindow(_v16[1]);
							} else {
								_t118 =  *0x6d62f8; // 0x0
								_v16[3] = DefWindowProcW(_t118, _t122, _v16[1], _v16[2]);
							}
						}
					}
					L21:
					_pop(_t165);
					 *[fs:eax] = _t165;
					_pop(_t166);
					 *[fs:eax] = _t166;
					_push(E00615C85);
					E0040A1EC( &_v172);
					return E0040A228( &_v12, 2);
				}
			}






































                                                                                          0x006158c4
                                                                                          0x006158c4
                                                                                          0x006158c4
                                                                                          0x006158c5
                                                                                          0x006158c7
                                                                                          0x006158ce
                                                                                          0x006158cf
                                                                                          0x006158d2
                                                                                          0x006158d8
                                                                                          0x006158db
                                                                                          0x006158de
                                                                                          0x006158e3
                                                                                          0x006158e4
                                                                                          0x006158e9
                                                                                          0x006158ec
                                                                                          0x006158f1
                                                                                          0x006158f2
                                                                                          0x006158f7
                                                                                          0x006158fa
                                                                                          0x00615900
                                                                                          0x00615904
                                                                                          0x00615907
                                                                                          0x00615986
                                                                                          0x0061598b
                                                                                          0x0061598b
                                                                                          0x00615991
                                                                                          0x006159af
                                                                                          0x006159b0
                                                                                          0x006159b5
                                                                                          0x006159b8
                                                                                          0x006159c6
                                                                                          0x006159cd
                                                                                          0x006159ce
                                                                                          0x006159d3
                                                                                          0x006159d6
                                                                                          0x006159d9
                                                                                          0x006159de
                                                                                          0x006159e2
                                                                                          0x006159e3
                                                                                          0x006159e8
                                                                                          0x006159eb
                                                                                          0x006159f4
                                                                                          0x006159fb
                                                                                          0x006159fe
                                                                                          0x00615a01
                                                                                          0x00615a06
                                                                                          0x00615a0b
                                                                                          0x00615a0b
                                                                                          0x00615a0d
                                                                                          0x00615993
                                                                                          0x00615993
                                                                                          0x00615993
                                                                                          0x00615994
                                                                                          0x00615a7c
                                                                                          0x00615a7d
                                                                                          0x00615a82
                                                                                          0x00615a85
                                                                                          0x00615a96
                                                                                          0x00615a9d
                                                                                          0x00615a9e
                                                                                          0x00615aa3
                                                                                          0x00615aa6
                                                                                          0x00615aa9
                                                                                          0x00615aae
                                                                                          0x00615ab1
                                                                                          0x00615abf
                                                                                          0x00615ac4
                                                                                          0x00615ac4
                                                                                          0x00615ae3
                                                                                          0x00615af3
                                                                                          0x00615b06
                                                                                          0x00615b0e
                                                                                          0x00615b17
                                                                                          0x00615b1a
                                                                                          0x00615b44
                                                                                          0x00615b4a
                                                                                          0x00615b4f
                                                                                          0x00615b56
                                                                                          0x00615b59
                                                                                          0x0061599a
                                                                                          0x0061599a
                                                                                          0x0061599a
                                                                                          0x0061599b
                                                                                          0x00615b72
                                                                                          0x00615b73
                                                                                          0x00615b78
                                                                                          0x00615b7b
                                                                                          0x00615b83
                                                                                          0x00615b9e
                                                                                          0x00615ba6
                                                                                          0x00615baf
                                                                                          0x00615bb2
                                                                                          0x006159a1
                                                                                          0x006159a1
                                                                                          0x006159a2
                                                                                          0x00615bc5
                                                                                          0x00615bc6
                                                                                          0x00615bcb
                                                                                          0x00615bce
                                                                                          0x00615bd6
                                                                                          0x00615bf1
                                                                                          0x00615bf9
                                                                                          0x00615c02
                                                                                          0x00615c05
                                                                                          0x00615c05
                                                                                          0x006159a2
                                                                                          0x0061599b
                                                                                          0x00000000
                                                                                          0x00615994
                                                                                          0x00615909
                                                                                          0x00615909
                                                                                          0x0061590e
                                                                                          0x0061591d
                                                                                          0x00615926
                                                                                          0x0061592b
                                                                                          0x00615932
                                                                                          0x00615941
                                                                                          0x00615910
                                                                                          0x00615910
                                                                                          0x00615911
                                                                                          0x0061594b
                                                                                          0x00615952
                                                                                          0x00615955
                                                                                          0x00615959
                                                                                          0x00615968
                                                                                          0x00615913
                                                                                          0x00615916
                                                                                          0x00615979
                                                                                          0x00615918
                                                                                          0x00615c25
                                                                                          0x00615c33
                                                                                          0x00615c33
                                                                                          0x00615916
                                                                                          0x00615911
                                                                                          0x00615c36
                                                                                          0x00615c38
                                                                                          0x00615c3b
                                                                                          0x00615c5a
                                                                                          0x00615c5d
                                                                                          0x00615c60
                                                                                          0x00615c6b
                                                                                          0x00615c7d
                                                                                          0x00615c7d

                                                                                          APIs
                                                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00615941
                                                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00615968
                                                                                          • SetForegroundWindow.USER32(?,00000000,00615C40,?,00000000,00615C7E), ref: 00615979
                                                                                          • DefWindowProcW.USER32(00000000,?,?,?,00000000,00615C40,?,00000000,00615C7E), ref: 00615C2B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePostWindow$ForegroundProc
                                                                                          • String ID: ,hm$Cannot evaluate variable because [Code] isn't running yet
                                                                                          • API String ID: 602442252-4088602279
                                                                                          • Opcode ID: 833ed96acbd7ce296f744c21c7c8491294494bd9aa0cbe59d904f657d70f1bea
                                                                                          • Instruction ID: a4d9e41ba68ff62660f6698438dd6fdd69331843db6522f8d42236939986de27
                                                                                          • Opcode Fuzzy Hash: 833ed96acbd7ce296f744c21c7c8491294494bd9aa0cbe59d904f657d70f1bea
                                                                                          • Instruction Fuzzy Hash: F691BC34A04704EFD711DF69D8A1F99FBB6EB89700F19C4AAF8059B7A1C634AD80CB54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060D8B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 78%
                                                                                          			E0060D8B0(char __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v41;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				void* __ecx;
				char _t90;
				char _t167;
				char _t168;
				intOrPtr _t171;
				intOrPtr _t179;
				intOrPtr _t186;
				intOrPtr _t207;
				intOrPtr _t217;
				intOrPtr _t218;

				_t215 = __esi;
				_t214 = __edi;
				_t217 = _t218;
				_t171 = 8;
				goto L1;
				L4:
				if(E005C77E8() != 0) {
					__eflags = _t167;
					if(__eflags == 0) {
						E0060D650(_v8, _t167,  &_v68, _t214, _t215, __eflags);
						E0040A5F0( &_v8, _v68);
						__eflags = _v12;
						if(__eflags != 0) {
							E0060D650(_v12, _t167,  &_v72, _t214, _t215, __eflags);
							E0040A5F0( &_v12, _v72);
						}
					}
					_t90 = E0060C558(_t167, _v12, _v8, 5);
					__eflags = _t90;
					if(_t90 == 0) {
						E0060CE84(L"MoveFileEx");
					}
					__eflags = 0;
					_pop(_t186);
					 *[fs:eax] = _t186;
					_push(E0060DBD9);
					E0040A228( &_v72, 7);
					return E0040A228( &_v32, 7);
				} else {
					E005C7430( &_v16);
					E005C4EA4(_v16,  &_v56);
					E0040B4C8( &_v20, L"WININIT.INI", _v56);
					E0060D294(0, _t167, L".tmp", _v16, _t214, _t215,  &_v24);
					_push(_t217);
					_push(0x60db3e);
					_push( *[fs:eax]);
					 *[fs:eax] = _t218;
					_v36 = 0;
					_v40 = 0;
					_push(_t217);
					_push(0x60dae2);
					_push( *[fs:eax]);
					 *[fs:eax] = _t218;
					WritePrivateProfileStringW(0, 0, 0, E0040B278(_v20));
					_v36 = E005CBFB8(1, 1, 0, 3);
					_t179 = _v24;
					_v40 = E005CBFB8(1, 0, 1, 0);
					_v41 = 0;
					_t168 = 0;
					while(E005CC258(_v36) == 0) {
						E005CC268(_v36, _t168,  &_v28, _t214, _t215, __eflags);
						E004225EC(_v28, 1,  &_v32, _t215);
						__eflags = _v32;
						if(__eflags == 0) {
							L11:
							E005CC5A0(_v40, 1, _v28, _t215, __eflags);
							_t168 = 0;
							__eflags = 0;
							continue;
						} else {
							__eflags =  *_v32 - 0x5b;
							if(__eflags != 0) {
								goto L11;
							} else {
								__eflags = E00422368(_v32, _t179, L"[rename]");
								if(__eflags != 0) {
									__eflags = _v41;
									if(__eflags == 0) {
										goto L11;
									}
								} else {
									_v41 = 1;
									goto L11;
								}
							}
						}
						break;
					}
					_t223 = _v41;
					if(_v41 == 0) {
						E005CC5A0(_v40, _t168, L"[rename]", _t215, _t223);
					}
					_t224 = _v12;
					if(_v12 == 0) {
						E0040A5F0( &_v32, 0x60dc48);
					} else {
						E005C73D8(_v12, _t179,  &_v32, _t224);
					}
					_push(_v32);
					_push(0x60dc5c);
					E005C73D8(_v8, _t179,  &_v64, _t224);
					_push(_v64);
					E0040B550( &_v60, _t168, 3, _t214, _t215);
					E005CC5A0(_v40, _t168, _v60, _t215, _t224);
					_t225 = _t168;
					if(_t168 != 0) {
						E005CC5A0(_v40, _t168, _v28, _t215, _t225);
					}
					while(E005CC258(_v36) == 0) {
						E005CC268(_v36, _t168,  &_v28, _t214, _t215, __eflags);
						E005CC5A0(_v40, _t168, _v28, _t215, __eflags);
					}
					_pop(_t207);
					 *[fs:eax] = _t207;
					_push(E0060DAE9);
					E00408444(_v40);
					return E00408444(_v36);
				}
				L1:
				_push(0);
				_push(0);
				_t171 = _t171 - 1;
				if(_t171 != 0) {
					goto L1;
				} else {
					_t1 =  &_v8;
					 *_t1 = _t171;
					_push(__esi);
					_push(__edi);
					_v12 =  *_t1;
					_v8 = __edx;
					_t167 = __eax;
					E0040A2AC(_v8);
					E0040A2AC(_v12);
					_push(_t217);
					_push(0x60dbd2);
					 *[fs:eax] = _t218;
					E005C52C8(_v8,  &_v48, _t217,  *[fs:eax]);
					E0040A5F0( &_v8, _v48);
					if(_v12 != 0) {
						E005C52C8(_v12,  &_v52, _t217);
						E0040A5F0( &_v12, _v52);
					}
				}
				goto L4;
			}






























                                                                                          0x0060d8b0
                                                                                          0x0060d8b0
                                                                                          0x0060d8b1
                                                                                          0x0060d8b4
                                                                                          0x0060d8b4
                                                                                          0x0060d91e
                                                                                          0x0060d925
                                                                                          0x0060db57
                                                                                          0x0060db59
                                                                                          0x0060db61
                                                                                          0x0060db6c
                                                                                          0x0060db71
                                                                                          0x0060db75
                                                                                          0x0060db7d
                                                                                          0x0060db88
                                                                                          0x0060db88
                                                                                          0x0060db75
                                                                                          0x0060db97
                                                                                          0x0060db9c
                                                                                          0x0060db9e
                                                                                          0x0060dba5
                                                                                          0x0060dba5
                                                                                          0x0060dbaa
                                                                                          0x0060dbac
                                                                                          0x0060dbaf
                                                                                          0x0060dbb2
                                                                                          0x0060dbbf
                                                                                          0x0060dbd1
                                                                                          0x0060d92b
                                                                                          0x0060d92e
                                                                                          0x0060d939
                                                                                          0x0060d949
                                                                                          0x0060d95c
                                                                                          0x0060d963
                                                                                          0x0060d964
                                                                                          0x0060d969
                                                                                          0x0060d96c
                                                                                          0x0060d971
                                                                                          0x0060d976
                                                                                          0x0060d97b
                                                                                          0x0060d97c
                                                                                          0x0060d981
                                                                                          0x0060d984
                                                                                          0x0060d996
                                                                                          0x0060d9b0
                                                                                          0x0060d9b9
                                                                                          0x0060d9c8
                                                                                          0x0060d9cb
                                                                                          0x0060d9cf
                                                                                          0x0060da24
                                                                                          0x0060d9d9
                                                                                          0x0060d9e6
                                                                                          0x0060d9eb
                                                                                          0x0060d9ef
                                                                                          0x0060da17
                                                                                          0x0060da1d
                                                                                          0x0060da22
                                                                                          0x0060da22
                                                                                          0x00000000
                                                                                          0x0060d9f1
                                                                                          0x0060d9f4
                                                                                          0x0060d9f8
                                                                                          0x00000000
                                                                                          0x0060d9fa
                                                                                          0x0060da07
                                                                                          0x0060da09
                                                                                          0x0060da11
                                                                                          0x0060da15
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0060da0b
                                                                                          0x0060da0b
                                                                                          0x00000000
                                                                                          0x0060da0b
                                                                                          0x0060da09
                                                                                          0x0060d9f8
                                                                                          0x00000000
                                                                                          0x0060d9ef
                                                                                          0x0060da30
                                                                                          0x0060da34
                                                                                          0x0060da3e
                                                                                          0x0060da3e
                                                                                          0x0060da43
                                                                                          0x0060da47
                                                                                          0x0060da5e
                                                                                          0x0060da49
                                                                                          0x0060da4f
                                                                                          0x0060da4f
                                                                                          0x0060da63
                                                                                          0x0060da66
                                                                                          0x0060da71
                                                                                          0x0060da76
                                                                                          0x0060da81
                                                                                          0x0060da8c
                                                                                          0x0060da91
                                                                                          0x0060da93
                                                                                          0x0060da9b
                                                                                          0x0060da9b
                                                                                          0x0060dab8
                                                                                          0x0060daa8
                                                                                          0x0060dab3
                                                                                          0x0060dab3
                                                                                          0x0060dac6
                                                                                          0x0060dac9
                                                                                          0x0060dacc
                                                                                          0x0060dad4
                                                                                          0x0060dae1
                                                                                          0x0060dae1
                                                                                          0x0060d8b9
                                                                                          0x0060d8b9
                                                                                          0x0060d8bb
                                                                                          0x0060d8bd
                                                                                          0x0060d8be
                                                                                          0x00000000
                                                                                          0x0060d8c0
                                                                                          0x0060d8c0
                                                                                          0x0060d8c0
                                                                                          0x0060d8c4
                                                                                          0x0060d8c5
                                                                                          0x0060d8c6
                                                                                          0x0060d8c9
                                                                                          0x0060d8cc
                                                                                          0x0060d8d1
                                                                                          0x0060d8d9
                                                                                          0x0060d8e0
                                                                                          0x0060d8e1
                                                                                          0x0060d8e9
                                                                                          0x0060d8f2
                                                                                          0x0060d8fd
                                                                                          0x0060d906
                                                                                          0x0060d90e
                                                                                          0x0060d919
                                                                                          0x0060d919
                                                                                          0x0060d906
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0060D996
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: PrivateProfileStringWrite
                                                                                          • String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
                                                                                          • API String ID: 390214022-3304407042
                                                                                          • Opcode ID: 3870244bf63cd9f105509945eaec42f9e735764985220d5c66c461e9ff67e3f1
                                                                                          • Instruction ID: 9ccae61fee5444c96898e798bd08ad00ad1f0a42c005b5ee0ec7678d9f590d11
                                                                                          • Opcode Fuzzy Hash: 3870244bf63cd9f105509945eaec42f9e735764985220d5c66c461e9ff67e3f1
                                                                                          • Instruction Fuzzy Hash: 3E810974A44209AFDB04EBE5C882BDEBBB6EF88304F504669E400B73D1E775AE45CB54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00408E18 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00408E18(signed char* __eax, void* __edx, void* __eflags) {
				void* _t49;
				signed char _t56;
				intOrPtr _t57;
				signed char _t59;
				void* _t70;
				signed char* _t71;
				intOrPtr _t72;
				signed char* _t73;

				_t70 = __edx;
				_t71 = __eax;
				_t72 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t73 = E004092D8(_t71);
					if( *_t73 != 0 || _t70 == 0) {
						break;
					}
					_t73[1] = 0;
					if(_t72 <= 0) {
						while(1) {
							L17:
							_t56 =  *_t71;
							if(_t56 == 0) {
								goto L1;
							}
							asm("lock cmpxchg [esi], edx");
							if(_t56 != _t56) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t73[4] = GetTickCount();
								E0040901C(_t71);
								_t57 =  *0x6cf8fc; // 0x6c76d4
								 *((intOrPtr*)(_t57 + 0x10))();
								 *_t73 = 0 == 0;
								if(_t70 != 0xffffffff) {
									_t73[8] = GetTickCount();
									if(_t70 <= _t73[8] - _t73[4]) {
										_t70 = 0;
									} else {
										_t70 = _t70 - _t73[8] - _t73[4];
									}
								}
								if( *_t73 == 0) {
									do {
										asm("lock cmpxchg [esi], edx");
									} while ( *_t71 !=  *_t71);
									_t73[1] = 1;
								} else {
									while(1) {
										_t59 =  *_t71;
										if((_t59 & 0x00000001) != 0) {
											goto L29;
										}
										asm("lock cmpxchg [esi], edx");
										if(_t59 != _t59) {
											continue;
										}
										_t73[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t73[1] == 0);
							if( *_t73 != 0) {
								_t71[8] = GetCurrentThreadId();
								_t71[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t73[4] = GetTickCount();
					_t73[0xc] = 0;
					if(_t72 <= 0) {
						L13:
						if(_t70 == 0xffffffff) {
							goto L17;
						}
						_t73[8] = GetTickCount();
						_t49 = _t73[8] - _t73[4];
						if(_t70 > _t49) {
							_t70 = _t70 - _t49;
							goto L17;
						}
						 *_t73 = 0;
						break;
					}
					L5:
					L5:
					if(_t70 == 0xffffffff || _t70 > GetTickCount() - _t73[4]) {
						goto L8;
					} else {
						 *_t73 = 0;
					}
					break;
					L8:
					if( *_t71 > 1) {
						goto L13;
					}
					if( *_t71 != 0) {
						L12:
						E00408AF8( &(_t73[0xc]));
						_t72 = _t72 - 1;
						if(_t72 > 0) {
							goto L5;
						}
						goto L13;
					}
					asm("lock cmpxchg [esi], edx");
					if(0 != 0) {
						goto L12;
					}
					_t71[8] = GetCurrentThreadId();
					_t71[4] = 1;
					 *_t73 = 1;
					break;
				}
				L32:
				return  *_t73 & 0x000000ff;
			}











                                                                                          0x00408e1f
                                                                                          0x00408e21
                                                                                          0x00408e23
                                                                                          0x00408e26
                                                                                          0x00408e26
                                                                                          0x00408e2d
                                                                                          0x00408e34
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408e42
                                                                                          0x00408e49
                                                                                          0x00408ee1
                                                                                          0x00408ee1
                                                                                          0x00408ee1
                                                                                          0x00408ee5
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408ef0
                                                                                          0x00408ef6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408ef8
                                                                                          0x00408ef8
                                                                                          0x00408efd
                                                                                          0x00408f03
                                                                                          0x00408f0a
                                                                                          0x00408f14
                                                                                          0x00408f19
                                                                                          0x00408f20
                                                                                          0x00408f27
                                                                                          0x00408f35
                                                                                          0x00408f43
                                                                                          0x00408f37
                                                                                          0x00408f3f
                                                                                          0x00408f3f
                                                                                          0x00408f35
                                                                                          0x00408f49
                                                                                          0x00408f6b
                                                                                          0x00408f74
                                                                                          0x00408f78
                                                                                          0x00408f7c
                                                                                          0x00000000
                                                                                          0x00408f4b
                                                                                          0x00408f4b
                                                                                          0x00408f50
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408f5c
                                                                                          0x00408f62
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408f64
                                                                                          0x00000000
                                                                                          0x00408f64
                                                                                          0x00408f4b
                                                                                          0x00408f81
                                                                                          0x00408f81
                                                                                          0x00408f90
                                                                                          0x00408f97
                                                                                          0x00408f9a
                                                                                          0x00408f9a
                                                                                          0x00000000
                                                                                          0x00408f90
                                                                                          0x00000000
                                                                                          0x00408ee1
                                                                                          0x00408e54
                                                                                          0x00408e5a
                                                                                          0x00408e60
                                                                                          0x00408ebc
                                                                                          0x00408ebf
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408ec6
                                                                                          0x00408ece
                                                                                          0x00408ed4
                                                                                          0x00408edf
                                                                                          0x00000000
                                                                                          0x00408edf
                                                                                          0x00408ed6
                                                                                          0x00000000
                                                                                          0x00408ed6
                                                                                          0x00000000
                                                                                          0x00408e62
                                                                                          0x00408e65
                                                                                          0x00000000
                                                                                          0x00408e74
                                                                                          0x00408e74
                                                                                          0x00408e74
                                                                                          0x00000000
                                                                                          0x00408e7d
                                                                                          0x00408e80
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408e85
                                                                                          0x00408eae
                                                                                          0x00408eb2
                                                                                          0x00408eb7
                                                                                          0x00408eba
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408eba
                                                                                          0x00408e8e
                                                                                          0x00408e94
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00408e9b
                                                                                          0x00408e9e
                                                                                          0x00408ea5
                                                                                          0x00000000
                                                                                          0x00408ea5
                                                                                          0x00408fa1
                                                                                          0x00408fac

                                                                                          APIs
                                                                                            • Part of subcall function 004092D8: GetCurrentThreadId.KERNEL32 ref: 004092DB
                                                                                          • GetTickCount.KERNEL32 ref: 00408E4F
                                                                                          • GetTickCount.KERNEL32 ref: 00408E67
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00408E96
                                                                                          • GetTickCount.KERNEL32 ref: 00408EC1
                                                                                          • GetTickCount.KERNEL32 ref: 00408EF8
                                                                                          • GetTickCount.KERNEL32 ref: 00408F22
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00408F92
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountTick$CurrentThread
                                                                                          • String ID:
                                                                                          • API String ID: 3968769311-0
                                                                                          • Opcode ID: 094ce5351118283afc175fbaaedba332e5e9e8dbf3e5100810996754e08302f0
                                                                                          • Instruction ID: 216a2c916ba6e2f13aacbc2b486a5202febe2ca6ab096472d485461ede499aa8
                                                                                          • Opcode Fuzzy Hash: 094ce5351118283afc175fbaaedba332e5e9e8dbf3e5100810996754e08302f0
                                                                                          • Instruction Fuzzy Hash: FD4171712087429ED721AF78CA4031FBAD2AF94354F15897EE4D9D72C2DB7C9881874A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006A5F04 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 79%
                                                                                          			E006A5F04(void* __eax, void* __edx, intOrPtr _a4076) {
				char _v4120;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t6;
				void* _t11;
				signed char _t14;
				void* _t22;
				intOrPtr* _t23;
				void* _t24;
				void* _t28;
				long _t30;
				void* _t31;
				void* _t32;
				void* _t33;

				_push(__eax);
				_t6 = 2;
				do {
					_t32 = _t32 + 0xfffff004;
					_push(_t6);
					_t6 = _t6 - 1;
				} while (_t6 != 0);
				_t33 = _t32 + 4;
				_t28 = __edx;
				_t29 = _a4076;
				_t23 = E00414020(_t22, _a4076, GetModuleHandleW(L"kernel32.dll"), L"GetFinalPathNameByHandleW");
				if(_t23 == 0) {
					L11:
					_t11 = E0040A5A8(_t28, _t29);
				} else {
					_t14 = GetFileAttributesW(E0040B278(_t29));
					if(_t14 == 0xffffffff) {
						goto L11;
					} else {
						if((_t14 & 0x00000010) == 0) {
							_t30 = 0;
							__eflags = 0;
						} else {
							_t30 = 0x2000000;
						}
						_t31 = CreateFileW(E0040B278(_t29), 0, 7, 0, 3, _t30, 0);
						if(_t31 == 0xffffffff) {
							goto L11;
						} else {
							_t24 =  *_t23(_t31,  &_v4120, 0x1000, 0);
							CloseHandle(_t31);
							if(_t24 <= 0) {
								goto L11;
							} else {
								_t41 = _t24 - 0xff0;
								if(_t24 >= 0xff0) {
									goto L11;
								} else {
									_t11 = E006A5E1C(_t33, _t24, _t28, _t29, _t41);
								}
							}
						}
					}
				}
				return _t11;
			}


















                                                                                          0x006a5f08
                                                                                          0x006a5f09
                                                                                          0x006a5f0e
                                                                                          0x006a5f0e
                                                                                          0x006a5f14
                                                                                          0x006a5f15
                                                                                          0x006a5f15
                                                                                          0x006a5f1f
                                                                                          0x006a5f22
                                                                                          0x006a5f24
                                                                                          0x006a5f3b
                                                                                          0x006a5f3f
                                                                                          0x006a5fad
                                                                                          0x006a5fb1
                                                                                          0x006a5f41
                                                                                          0x006a5f49
                                                                                          0x006a5f51
                                                                                          0x00000000
                                                                                          0x006a5f53
                                                                                          0x006a5f55
                                                                                          0x006a5f5e
                                                                                          0x006a5f5e
                                                                                          0x006a5f57
                                                                                          0x006a5f57
                                                                                          0x006a5f57
                                                                                          0x006a5f78
                                                                                          0x006a5f7d
                                                                                          0x00000000
                                                                                          0x006a5f7f
                                                                                          0x006a5f8e
                                                                                          0x006a5f91
                                                                                          0x006a5f98
                                                                                          0x00000000
                                                                                          0x006a5f9a
                                                                                          0x006a5f9a
                                                                                          0x006a5fa0
                                                                                          0x00000000
                                                                                          0x006a5fa2
                                                                                          0x006a5fa6
                                                                                          0x006a5fa6
                                                                                          0x006a5fa0
                                                                                          0x006a5f98
                                                                                          0x006a5f7d
                                                                                          0x006a5f51
                                                                                          0x006a5fc0

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F30
                                                                                          • GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F49
                                                                                          • CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A5F73
                                                                                          • CloseHandle.KERNEL32(00000000), ref: 006A5F91
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandle$AttributesCloseCreateModule
                                                                                          • String ID: GetFinalPathNameByHandleW$kernel32.dll
                                                                                          • API String ID: 791737717-340263132
                                                                                          • Opcode ID: a85d96d83052cc77bc6f3ecbed71c9388927693d57a117c50d221e683e74690f
                                                                                          • Instruction ID: 33e75e3eedf917459a19461fb92274fc6dcf6f547d9e1cd84d4496d1484fa6be
                                                                                          • Opcode Fuzzy Hash: a85d96d83052cc77bc6f3ecbed71c9388927693d57a117c50d221e683e74690f
                                                                                          • Instruction Fuzzy Hash: FD110860740B043FE530B17A5C8BFBB204E8B96769F14013ABB1ADA3C2E9799D410D9A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B8141 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 50COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 51%
                                                                                          			E006B8141(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char* _t18;
				char* _t23;
				intOrPtr* _t25;
				intOrPtr _t29;
				intOrPtr _t32;
				void* _t34;
				intOrPtr _t42;
				intOrPtr _t44;
				void* _t45;
				void* _t48;

				if( *((char*)(_t48 - 0x21)) != 0) {
					_t18 =  *0x6cdfdc; // 0x6d62e4
					if( *_t18 != 0) {
						E00616130(L"Not restarting Windows because Uninstall is being run from the debugger.", __ebx, __edi, __esi);
					} else {
						E00616130(L"Restarting Windows.", __ebx, __edi, __esi);
						_t23 =  *0x6cdefc; // 0x6d6825
						 *_t23 = 1;
						if(E0060F6D8() == 0) {
							_t25 =  *0x6cdec4; // 0x6d579c
							SetForegroundWindow( *( *_t25 + 0x188));
							_push(1);
							_push(1);
							_t29 =  *0x6cded8; // 0x6d5c28
							_t3 = _t29 + 0x164; // 0x24db02c
							_push(E0040B278( *_t3));
							_t32 =  *0x6cded8; // 0x6d5c28
							_t4 = _t32 + 0x15c; // 0x245afe4
							_t34 = E0040B278( *_t4);
							_pop(_t45);
							E006AF190(_t34, __ebx, 0x30, _t45, __edi, __esi);
						}
					}
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(E006B8200);
				E0040A1C8(_t48 - 0x48);
				E0040A228(_t48 - 0x3c, 5);
				_t44 =  *0x4012b8; // 0x4012bc
				E0040C024(_t48 - 0x20, 7, _t44);
				return E0040A1EC(_t48 - 4);
			}













                                                                                          0x006b8145
                                                                                          0x006b8147
                                                                                          0x006b814f
                                                                                          0x006b81b6
                                                                                          0x006b8151
                                                                                          0x006b8156
                                                                                          0x006b815b
                                                                                          0x006b8160
                                                                                          0x006b816a
                                                                                          0x006b816c
                                                                                          0x006b817a
                                                                                          0x006b817f
                                                                                          0x006b8181
                                                                                          0x006b8183
                                                                                          0x006b8188
                                                                                          0x006b8193
                                                                                          0x006b8194
                                                                                          0x006b8199
                                                                                          0x006b819f
                                                                                          0x006b81a9
                                                                                          0x006b81aa
                                                                                          0x006b81aa
                                                                                          0x006b816a
                                                                                          0x006b814f
                                                                                          0x006b81bd
                                                                                          0x006b81c0
                                                                                          0x006b81c3
                                                                                          0x006b81cb
                                                                                          0x006b81d8
                                                                                          0x006b81e5
                                                                                          0x006b81eb
                                                                                          0x006b81f8

                                                                                          APIs
                                                                                            • Part of subcall function 0060F6D8: GetCurrentProcess.KERNEL32(00000028), ref: 0060F6E8
                                                                                            • Part of subcall function 0060F6D8: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0060F6EE
                                                                                          • SetForegroundWindow.USER32(?), ref: 006B817A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Process$CurrentForegroundOpenTokenWindow
                                                                                          • String ID: %hm$(\m$Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.$bm
                                                                                          • API String ID: 3179053593-36556386
                                                                                          • Opcode ID: d58cf3f0ffb3ee88448ddcf2a0a86469b0316ae1882d33787e1b976aa911cd29
                                                                                          • Instruction ID: d1bb377931262cf507ba46983c8bd46f5a1d5c2f393bef5d4bb5aec732555b7a
                                                                                          • Opcode Fuzzy Hash: d58cf3f0ffb3ee88448ddcf2a0a86469b0316ae1882d33787e1b976aa911cd29
                                                                                          • Instruction Fuzzy Hash: 621130746042049FD700EB69DD86FE837EAAB49304F5540BAF401AB7A2CE79AC82C759
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00409E60 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 43%
                                                                                          			E00409E60(void* __ecx) {
				long _v4;
				void* _t3;
				void* _t9;

				if( *0x6cf05c == 0) {
					if( *0x6c5036 == 0) {
						_push(0);
						_push("Error");
						_push("Runtime error     at 00000000");
						_push(0);
						L0040529C();
					}
					return _t3;
				} else {
					if( *0x6cf348 == 0xd7b2 &&  *0x6cf350 > 0) {
						 *0x6cf360();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E0040AC70(0x409ef4);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}






                                                                                          0x00409e68
                                                                                          0x00409ece
                                                                                          0x00409ed0
                                                                                          0x00409ed2
                                                                                          0x00409ed7
                                                                                          0x00409edc
                                                                                          0x00409ede
                                                                                          0x00409ede
                                                                                          0x00409ee4
                                                                                          0x00409e6a
                                                                                          0x00409e73
                                                                                          0x00409e83
                                                                                          0x00409e83
                                                                                          0x00409e9f
                                                                                          0x00409eb2
                                                                                          0x00409ec6
                                                                                          0x00409ec6

                                                                                          APIs
                                                                                          • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409E99
                                                                                          • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409E9F
                                                                                          • GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409EBA
                                                                                          • WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409EC0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite
                                                                                          • String ID: Error$Runtime error at 00000000
                                                                                          • API String ID: 3320372497-2970929446
                                                                                          • Opcode ID: f0102d395586047e2231baad8f9263709275fc638e69f42f5077cbeb5f490e35
                                                                                          • Instruction ID: a01582976990e38fcf300ac2ca1e4f1bd102d55210953f65d1fcb3aa769fb624
                                                                                          • Opcode Fuzzy Hash: f0102d395586047e2231baad8f9263709275fc638e69f42f5077cbeb5f490e35
                                                                                          • Instruction Fuzzy Hash: 52F04FA0A44780BAEB10B7A19C07F7B261AD741B28F10567FB214B91D3C6B85CC49AE9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0043171C Relevance: 9.1, APIs: 6, Instructions: 144COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 77%
                                                                                          			E0043171C(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				signed short* _v808;
				void* __ebp;
				signed char _t55;
				signed int _t64;
				void* _t72;
				intOrPtr* _t83;
				void* _t103;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr* _t118;
				void* _t122;
				intOrPtr _t123;
				char* _t124;
				void* _t125;

				_t110 = __ecx;
				_v780 = __ecx;
				_v808 = __edx;
				_v776 = __eax;
				if((_v808[0] & 0x00000020) == 0) {
					L00430EC8(0x80070057);
				}
				_t55 =  *_v808 & 0x0000ffff;
				if((_t55 & 0x00000fff) != 0xc) {
					_push(_v808);
					_push(_v776);
					L0042F04C();
					return L00430EC8(_v776);
				} else {
					if((_t55 & 0x00000040) == 0) {
						_v792 = _v808[4];
					} else {
						_v792 =  *(_v808[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t103 = _v788 - 1;
					if(_t103 < 0) {
						L9:
						_push( &_v772);
						_t64 = _v788;
						_push(_t64);
						_push(0xc);
						L0042F628();
						_t123 = _t64;
						if(_t123 == 0) {
							E00430C20(_t110);
						}
						L00431164(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t123;
						_t105 = _v788 - 1;
						if(_t105 < 0) {
							L14:
							_t107 = _v788 - 1;
							if(E00431694(_v788 - 1, _t125) != 0) {
								L0042F650();
								L00430EC8(_v792);
								L0042F650();
								L00430EC8( &_v260);
								_v780(_t123,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t72 = E004316C4(_t107, _t125);
						} else {
							_t108 = _t105 + 1;
							_t83 =  &_v768;
							_t118 =  &_v260;
							do {
								 *_t118 =  *_t83;
								_t118 = _t118 + 4;
								_t83 = _t83 + 8;
								_t108 = _t108 - 1;
							} while (_t108 != 0);
							do {
								goto L14;
							} while (_t72 != 0);
							return _t72;
						}
					} else {
						_t109 = _t103 + 1;
						_t122 = 0;
						_t124 =  &_v772;
						do {
							_v804 = _t124;
							_push(_v804 + 4);
							_t23 = _t122 + 1; // 0x1
							_push(_v792);
							L0042F630();
							L00430EC8(_v792);
							_push( &_v784);
							_t26 = _t122 + 1; // 0x1
							_push(_v792);
							L0042F638();
							L00430EC8(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t122 = _t122 + 1;
							_t124 = _t124 + 8;
							_t109 = _t109 - 1;
						} while (_t109 != 0);
						goto L9;
					}
				}
			}





























                                                                                          0x0043171c
                                                                                          0x00431728
                                                                                          0x0043172e
                                                                                          0x00431734
                                                                                          0x00431744
                                                                                          0x0043174b
                                                                                          0x0043174b
                                                                                          0x00431756
                                                                                          0x00431764
                                                                                          0x004318ef
                                                                                          0x004318f6
                                                                                          0x004318f7
                                                                                          0x00000000
                                                                                          0x0043176a
                                                                                          0x0043176d
                                                                                          0x0043178b
                                                                                          0x0043176f
                                                                                          0x0043177a
                                                                                          0x0043177a
                                                                                          0x0043179a
                                                                                          0x004317a6
                                                                                          0x004317a9
                                                                                          0x00431816
                                                                                          0x0043181c
                                                                                          0x0043181d
                                                                                          0x00431823
                                                                                          0x00431824
                                                                                          0x00431826
                                                                                          0x0043182b
                                                                                          0x0043182f
                                                                                          0x00431831
                                                                                          0x00431831
                                                                                          0x0043183c
                                                                                          0x00431847
                                                                                          0x00431852
                                                                                          0x0043185b
                                                                                          0x0043185e
                                                                                          0x0043187a
                                                                                          0x00431881
                                                                                          0x0043188c
                                                                                          0x004318a3
                                                                                          0x004318a8
                                                                                          0x004318bc
                                                                                          0x004318c1
                                                                                          0x004318d4
                                                                                          0x004318d4
                                                                                          0x004318dd
                                                                                          0x00431860
                                                                                          0x00431860
                                                                                          0x00431861
                                                                                          0x00431867
                                                                                          0x0043186d
                                                                                          0x0043186f
                                                                                          0x00431871
                                                                                          0x00431874
                                                                                          0x00431877
                                                                                          0x00431877
                                                                                          0x0043187a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0043187a
                                                                                          0x004317ab
                                                                                          0x004317ab
                                                                                          0x004317ac
                                                                                          0x004317ae
                                                                                          0x004317b4
                                                                                          0x004317b6
                                                                                          0x004317c5
                                                                                          0x004317c6
                                                                                          0x004317d0
                                                                                          0x004317d1
                                                                                          0x004317d6
                                                                                          0x004317e1
                                                                                          0x004317e2
                                                                                          0x004317ec
                                                                                          0x004317ed
                                                                                          0x004317f2
                                                                                          0x0043180d
                                                                                          0x0043180f
                                                                                          0x00431810
                                                                                          0x00431813
                                                                                          0x00431813
                                                                                          0x00000000
                                                                                          0x004317b4
                                                                                          0x004317a9

                                                                                          APIs
                                                                                          • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004317D1
                                                                                          • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004317ED
                                                                                          • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00431826
                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004318A3
                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004318BC
                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 004318F7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                          • String ID:
                                                                                          • API String ID: 351091851-0
                                                                                          • Opcode ID: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
                                                                                          • Instruction ID: ede279f2d9249a03c5eeb803d5e3445196a0ad83b08d93498a0369a0c14e8414
                                                                                          • Opcode Fuzzy Hash: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
                                                                                          • Instruction Fuzzy Hash: 41512D75A002299FCB62DB59CD81BD9B3FCAF0C304F4455EAE508E7212D634AF858F58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006AE6F8 Relevance: 9.1, APIs: 6, Instructions: 66COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E006AE6F8(signed int __eax) {
				intOrPtr* _t14;
				signed int _t18;
				intOrPtr* _t19;
				intOrPtr* _t23;
				signed int _t26;
				long _t27;
				intOrPtr* _t29;
				intOrPtr* _t33;
				signed int _t37;
				intOrPtr* _t38;

				_t37 = __eax;
				 *0x6d6827 = __eax ^ 0x00000001;
				_t14 =  *0x6cdec4; // 0x6d579c
				_t18 = GetWindowLongW( *( *_t14 + 0x188), 0xffffffec) & 0xffffff00 | (_t17 & 0x00000080) == 0x00000000;
				if(_t37 != _t18) {
					_t19 =  *0x6cdec4; // 0x6d579c
					SetWindowPos( *( *_t19 + 0x188), 0, 0, 0, 0, 0, 0x97);
					_t23 =  *0x6cdec4; // 0x6d579c
					_t26 = GetWindowLongW( *( *_t23 + 0x188), 0xffffffec);
					if(_t37 == 0) {
						_t27 = _t26 | 0x00000080;
					} else {
						_t27 = _t26 & 0xffffff7f;
					}
					_t38 =  *0x6cdec4; // 0x6d579c
					SetWindowLongW( *( *_t38 + 0x188), 0xffffffec, _t27);
					if(_t37 == 0) {
						_t29 =  *0x6cdec4; // 0x6d579c
						return SetWindowPos( *( *_t29 + 0x188), 0, 0, 0, 0, 0, 0x57);
					} else {
						_t33 =  *0x6cdec4; // 0x6d579c
						return ShowWindow( *( *_t33 + 0x188), 5);
					}
				}
				return _t18;
			}













                                                                                          0x006ae6f9
                                                                                          0x006ae6ff
                                                                                          0x006ae704
                                                                                          0x006ae71b
                                                                                          0x006ae720
                                                                                          0x006ae735
                                                                                          0x006ae743
                                                                                          0x006ae748
                                                                                          0x006ae758
                                                                                          0x006ae75f
                                                                                          0x006ae768
                                                                                          0x006ae761
                                                                                          0x006ae761
                                                                                          0x006ae761
                                                                                          0x006ae76d
                                                                                          0x006ae77f
                                                                                          0x006ae786
                                                                                          0x006ae7ab
                                                                                          0x00000000
                                                                                          0x006ae788
                                                                                          0x006ae78a
                                                                                          0x00000000
                                                                                          0x006ae798
                                                                                          0x006ae786
                                                                                          0x006ae7bf

                                                                                          APIs
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 006AE714
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,006B78BD,00000000,006B81F9), ref: 006AE743
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 006AE758
                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 006AE77F
                                                                                          • ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 006AE798
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 006AE7B9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Long$Show
                                                                                          • String ID:
                                                                                          • API String ID: 3609083571-0
                                                                                          • Opcode ID: 20e26916085c5e6554055c250da2d7273406bdd96b7cd9a8ba3bc571ba314315
                                                                                          • Instruction ID: c5f2d3f14be40374ea6ae40072baf741f42d7864aa45c80e1917733d0618a2ec
                                                                                          • Opcode Fuzzy Hash: 20e26916085c5e6554055c250da2d7273406bdd96b7cd9a8ba3bc571ba314315
                                                                                          • Instruction Fuzzy Hash: FC111C75745200AFD700EB68DD81FE237EAAB9E314F4541A5F6158F3E2CA65EC40DB50
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405A04 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 68%
                                                                                          			E00405A04(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				intOrPtr* _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				intOrPtr* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				intOrPtr* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t95 = __eax;
				_t129 =  *0x6cf05d; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t2 = _t162 + 0x10010; // 0x1002c
							_t156 = _t2 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t121 = VirtualAlloc(0, _t156, 0x101000, 4);
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00405764();
								_t99 =  *0x6d1b84; // 0x6d1b80
								 *_t147 = 0x6d1b80;
								 *0x6d1b84 = _t121;
								 *((intOrPtr*)(_t147 + 4)) = _t99;
								 *_t99 = _t121;
								 *0x6d1b7c = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t67 = _t95 + 0xd3; // 0xef
						_t125 = (_t67 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x6cfaec], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x6cf98d;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x6cfaec], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t68 = _t125 - 0xb30; // -2673
						_t141 = _t68;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x6cfafc + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x6cfaf8;
							if((0xfffffffe << _t132 &  *0x6cfaf8) == 0) {
								_t133 =  *0x6cfaf4; // 0xa9470
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E004056E8(_t125);
								} else {
									_t110 =  *0x6cfaf0; // 0x2eb9480
									_t109 = _t110 - _t125;
									 *0x6cfaf0 = _t109;
									 *0x6cfaf4 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x6cfaec = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x6cfb7c + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x6cfafc + _t142 * 4;
								 *_t80 =  *(0x6cfafc + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x6cfaf8], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E0040561C(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							_t93 = _t125 + 2; // 0xc1
							 *(_t159 - 4) = _t93;
							 *0x6cfaec = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					_t6 = __edx + 0x6cf994; // 0x68646460
					__eax =  *_t6 & 0x000000ff;
					__ebx = 0x6c5084 + ( *_t6 & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x6cf98d;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x6cf05d;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x6cfaec], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x6cf98d;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x6cfaec], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x6cfaf8;
							__eflags =  *(__ebx + 1) &  *0x6cfaf8;
							if(( *(__ebx + 1) &  *0x6cfaf8) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x6cfaf4; // 0xa9470
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E004056E8(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x6cfaec = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x6cfaf0; // 0x2eb9480
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x6cfaf4 =  *0x6cfaf4 - __edi;
									 *0x6cfaf0 = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x6cfafc + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x6cfafc + __eax * 4) + __eax * 8 * 4;
								__edi = 0x6cfb7c + ( *(0x6cfafc + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x6cfafc + __eax * 4;
									 *_t38 =  *(0x6cfafc + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x6cfaf8], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E0040561C(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0xa9476
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x6cfaec = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x2eb94a0
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}





























                                                                                          0x00405a04
                                                                                          0x00405a10
                                                                                          0x00405a16
                                                                                          0x00405c64
                                                                                          0x00405c69
                                                                                          0x00405d7c
                                                                                          0x00405d7d
                                                                                          0x00405d7f
                                                                                          0x004057b0
                                                                                          0x004057b4
                                                                                          0x004057b6
                                                                                          0x004057c0
                                                                                          0x004057d5
                                                                                          0x004057d9
                                                                                          0x004057db
                                                                                          0x004057dd
                                                                                          0x004057e3
                                                                                          0x004057e6
                                                                                          0x004057eb
                                                                                          0x004057f0
                                                                                          0x004057f6
                                                                                          0x004057fc
                                                                                          0x004057ff
                                                                                          0x00405801
                                                                                          0x00405808
                                                                                          0x00405808
                                                                                          0x00405811
                                                                                          0x00405d85
                                                                                          0x00405d85
                                                                                          0x00405d87
                                                                                          0x00405d87
                                                                                          0x00405c6f
                                                                                          0x00405c6f
                                                                                          0x00405c7b
                                                                                          0x00405c7e
                                                                                          0x00405c80
                                                                                          0x00405c28
                                                                                          0x00405c2d
                                                                                          0x00405c35
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405c37
                                                                                          0x00405c39
                                                                                          0x00405c40
                                                                                          0x00000000
                                                                                          0x00405c42
                                                                                          0x00405c44
                                                                                          0x00405c4e
                                                                                          0x00405c56
                                                                                          0x00405c5a
                                                                                          0x00000000
                                                                                          0x00405c5a
                                                                                          0x00405c56
                                                                                          0x00000000
                                                                                          0x00405c40
                                                                                          0x00405c28
                                                                                          0x00405c82
                                                                                          0x00405c82
                                                                                          0x00405c82
                                                                                          0x00405c8a
                                                                                          0x00405c8d
                                                                                          0x00405c97
                                                                                          0x00405c97
                                                                                          0x00405c9e
                                                                                          0x00405cb1
                                                                                          0x00405cb5
                                                                                          0x00405cbb
                                                                                          0x00405cd4
                                                                                          0x00405cda
                                                                                          0x00405cda
                                                                                          0x00405cdc
                                                                                          0x00405cfa
                                                                                          0x00405cde
                                                                                          0x00405cde
                                                                                          0x00405ce3
                                                                                          0x00405ce5
                                                                                          0x00405cea
                                                                                          0x00405cf3
                                                                                          0x00405cf3
                                                                                          0x00405cff
                                                                                          0x00405d07
                                                                                          0x00405cbd
                                                                                          0x00405cbd
                                                                                          0x00405cc7
                                                                                          0x00405ccf
                                                                                          0x00000000
                                                                                          0x00405ccf
                                                                                          0x00405ca0
                                                                                          0x00405ca3
                                                                                          0x00405ca6
                                                                                          0x00405d08
                                                                                          0x00405d08
                                                                                          0x00405d09
                                                                                          0x00405d0a
                                                                                          0x00405d11
                                                                                          0x00405d14
                                                                                          0x00405d17
                                                                                          0x00405d1a
                                                                                          0x00405d1c
                                                                                          0x00405d1e
                                                                                          0x00405d25
                                                                                          0x00405d27
                                                                                          0x00405d27
                                                                                          0x00405d27
                                                                                          0x00405d2e
                                                                                          0x00405d30
                                                                                          0x00405d30
                                                                                          0x00405d2e
                                                                                          0x00405d3c
                                                                                          0x00405d41
                                                                                          0x00405d41
                                                                                          0x00405d43
                                                                                          0x00405d64
                                                                                          0x00405d64
                                                                                          0x00405d64
                                                                                          0x00405d45
                                                                                          0x00405d45
                                                                                          0x00405d4b
                                                                                          0x00405d4e
                                                                                          0x00405d52
                                                                                          0x00405d58
                                                                                          0x00405d5a
                                                                                          0x00405d5a
                                                                                          0x00405d58
                                                                                          0x00405d69
                                                                                          0x00405d6c
                                                                                          0x00405d6f
                                                                                          0x00405d7b
                                                                                          0x00405d7b
                                                                                          0x00405c9e
                                                                                          0x00405a1c
                                                                                          0x00405a1c
                                                                                          0x00405a1e
                                                                                          0x00405a1e
                                                                                          0x00405a25
                                                                                          0x00405a2c
                                                                                          0x00405a84
                                                                                          0x00405a84
                                                                                          0x00405a89
                                                                                          0x00405a8d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405a8f
                                                                                          0x00405a8f
                                                                                          0x00405a92
                                                                                          0x00405a97
                                                                                          0x00405a9b
                                                                                          0x00405a9d
                                                                                          0x00405a9d
                                                                                          0x00405aa0
                                                                                          0x00405aa5
                                                                                          0x00405aa9
                                                                                          0x00405aab
                                                                                          0x00405aae
                                                                                          0x00405ab0
                                                                                          0x00405ab7
                                                                                          0x00000000
                                                                                          0x00405ab9
                                                                                          0x00405abb
                                                                                          0x00405ac0
                                                                                          0x00405ac5
                                                                                          0x00405ac9
                                                                                          0x00405ad1
                                                                                          0x00000000
                                                                                          0x00405ad1
                                                                                          0x00405ac9
                                                                                          0x00405ab7
                                                                                          0x00405aa9
                                                                                          0x00000000
                                                                                          0x00405a9b
                                                                                          0x00405a84
                                                                                          0x00405a2e
                                                                                          0x00405a2e
                                                                                          0x00405a31
                                                                                          0x00405a34
                                                                                          0x00405a39
                                                                                          0x00405a3b
                                                                                          0x00405a54
                                                                                          0x00405a57
                                                                                          0x00405a5b
                                                                                          0x00405a5d
                                                                                          0x00405a60
                                                                                          0x00405ad8
                                                                                          0x00405ad9
                                                                                          0x00405ada
                                                                                          0x00405ae1
                                                                                          0x00405ae3
                                                                                          0x00405ae3
                                                                                          0x00405ae8
                                                                                          0x00405af0
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405af2
                                                                                          0x00405af4
                                                                                          0x00405afb
                                                                                          0x00000000
                                                                                          0x00405afd
                                                                                          0x00405aff
                                                                                          0x00405b04
                                                                                          0x00405b09
                                                                                          0x00405b11
                                                                                          0x00405b15
                                                                                          0x00000000
                                                                                          0x00405b15
                                                                                          0x00405b11
                                                                                          0x00000000
                                                                                          0x00405afb
                                                                                          0x00405ae3
                                                                                          0x00405b1c
                                                                                          0x00405b20
                                                                                          0x00405b20
                                                                                          0x00405b26
                                                                                          0x00405b98
                                                                                          0x00405b9c
                                                                                          0x00405ba2
                                                                                          0x00405ba4
                                                                                          0x00405bcc
                                                                                          0x00405bd0
                                                                                          0x00405bd2
                                                                                          0x00405bd7
                                                                                          0x00405bd9
                                                                                          0x00405bdb
                                                                                          0x00000000
                                                                                          0x00405bdd
                                                                                          0x00405bdd
                                                                                          0x00405be2
                                                                                          0x00405be4
                                                                                          0x00405be5
                                                                                          0x00405be6
                                                                                          0x00405be7
                                                                                          0x00405be7
                                                                                          0x00405ba6
                                                                                          0x00405ba6
                                                                                          0x00405bac
                                                                                          0x00405bb0
                                                                                          0x00405bb6
                                                                                          0x00405bb8
                                                                                          0x00405bba
                                                                                          0x00405bba
                                                                                          0x00405bbc
                                                                                          0x00405bbe
                                                                                          0x00405bc4
                                                                                          0x00000000
                                                                                          0x00405bc4
                                                                                          0x00405b28
                                                                                          0x00405b28
                                                                                          0x00405b2b
                                                                                          0x00405b32
                                                                                          0x00405b39
                                                                                          0x00405b3c
                                                                                          0x00405b3f
                                                                                          0x00405b46
                                                                                          0x00405b49
                                                                                          0x00405b4c
                                                                                          0x00405b4f
                                                                                          0x00405b51
                                                                                          0x00405b53
                                                                                          0x00405b55
                                                                                          0x00405b5a
                                                                                          0x00405b5c
                                                                                          0x00405b5c
                                                                                          0x00405b5c
                                                                                          0x00405b63
                                                                                          0x00405b65
                                                                                          0x00405b65
                                                                                          0x00405b63
                                                                                          0x00405b6c
                                                                                          0x00405b71
                                                                                          0x00405b74
                                                                                          0x00405b7a
                                                                                          0x00405be8
                                                                                          0x00405be8
                                                                                          0x00405be8
                                                                                          0x00405b7c
                                                                                          0x00405b7c
                                                                                          0x00405b7e
                                                                                          0x00405b82
                                                                                          0x00405b84
                                                                                          0x00405b87
                                                                                          0x00405b8a
                                                                                          0x00405b8d
                                                                                          0x00405b91
                                                                                          0x00405b91
                                                                                          0x00405bed
                                                                                          0x00405bed
                                                                                          0x00405bed
                                                                                          0x00405bf0
                                                                                          0x00405bf3
                                                                                          0x00405bf5
                                                                                          0x00405bfa
                                                                                          0x00405bfc
                                                                                          0x00405bff
                                                                                          0x00405c06
                                                                                          0x00405c09
                                                                                          0x00405c09
                                                                                          0x00405c0c
                                                                                          0x00405c10
                                                                                          0x00405c13
                                                                                          0x00405c16
                                                                                          0x00405c18
                                                                                          0x00405c18
                                                                                          0x00405c1a
                                                                                          0x00405c1d
                                                                                          0x00405c20
                                                                                          0x00405c23
                                                                                          0x00405c24
                                                                                          0x00405c25
                                                                                          0x00405c26
                                                                                          0x00405c26
                                                                                          0x00405a62
                                                                                          0x00405a62
                                                                                          0x00405a62
                                                                                          0x00405a62
                                                                                          0x00405a66
                                                                                          0x00405a69
                                                                                          0x00405a6c
                                                                                          0x00405a6f
                                                                                          0x00405a70
                                                                                          0x00405a70
                                                                                          0x00405a3d
                                                                                          0x00405a3d
                                                                                          0x00405a41
                                                                                          0x00405a41
                                                                                          0x00405a44
                                                                                          0x00405a47
                                                                                          0x00405a4a
                                                                                          0x00405a74
                                                                                          0x00405a77
                                                                                          0x00405a7a
                                                                                          0x00405a7d
                                                                                          0x00405a80
                                                                                          0x00405a81
                                                                                          0x00405a4c
                                                                                          0x00405a4c
                                                                                          0x00405a4f
                                                                                          0x00405a50
                                                                                          0x00405a50
                                                                                          0x00405a4a
                                                                                          0x00405a3b

                                                                                          APIs
                                                                                          • Sleep.KERNEL32(00000000,0000001B,004062A4,024E8810,00408D1E,004090BF,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8,?,00429D26,005C7CEF), ref: 00405ABB
                                                                                          • Sleep.KERNEL32(0000000A,00000000,0000001B,004062A4,024E8810,00408D1E,004090BF,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8,?,00429D26), ref: 00405AD1
                                                                                          • Sleep.KERNEL32(00000000,?,-00000004,0000001B,004062A4,024E8810,00408D1E,004090BF,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8), ref: 00405AFF
                                                                                          • Sleep.KERNEL32(0000000A,00000000,?,-00000004,0000001B,004062A4,024E8810,00408D1E,004090BF,?,00000000,024E8810,00408D8D,00000000,00000220,00429CD8), ref: 00405B15
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: 8fe5dab37ab237f47134e71ba792b9a5302878e40ad5dc09ca2e32e20e77e8ae
                                                                                          • Instruction ID: 7a051e160dd760b70f5de690832b1da94a718f6c47d0b95a7d4eebd5f387ad29
                                                                                          • Opcode Fuzzy Hash: 8fe5dab37ab237f47134e71ba792b9a5302878e40ad5dc09ca2e32e20e77e8ae
                                                                                          • Instruction Fuzzy Hash: BCC1F272601B118BDB15CF69E884B27BBA2EB85310F18827FD4599F3D5C7B4A841CF94
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060D3B4 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 39%
                                                                                          			E0060D3B4(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v17;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				void* _t60;
				signed int _t63;
				intOrPtr _t77;
				void* _t83;
				intOrPtr _t86;

				_t64 = 0;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v16 = __edx;
				_v8 = __eax;
				E0040A2AC(_v8);
				_push(_t86);
				_push(0x60d4f1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t86;
				E005C4EA4(_v8,  &_v24);
				E0040A5F0( &_v8, _v24);
				_t83 = 0x123456;
				_t63 = 0;
				_v17 = 0;
				do {
					_t83 = _t83 + 1;
					if(_t83 > 0x1ffffff) {
						_t83 = 0;
					}
					_t90 = 0x123456 - _t83;
					if(0x123456 == _t83) {
						_t9 =  &_v32; // 0x6b7447
						E005C567C(_v8, _t64, _t9, _t90);
						_t11 =  &_v32; // 0x6b7447
						E005CD508(0x5a,  &_v28,  *_t11);
						_t64 = _v28;
						E00429008(_v28, 1);
						E004098C4();
					}
					_push(_v8);
					_push("_iu");
					E0060D21C(_t83, _t63,  &_v36, 0x123456, _t83);
					_push(_v36);
					_push(L".tmp");
					E0040B550( &_v12, _t63, 4, 0x123456, _t83);
					if(E005C6880(_t90) == 0) {
						_t63 = 1;
						_v17 = E005C685C(_v12);
						if(_v17 != 0) {
							_t60 = CreateFileW(E0040B278(_v12), 0xc0000000, 0, 0, 2, 0x80, 0);
							_t63 = 0 | _t60 != 0xffffffff;
							if(1 != 0) {
								CloseHandle(_t60);
							}
						}
					}
				} while (_t63 == 0);
				E0040A5A8(_v16, _v12);
				_pop(_t77);
				 *[fs:eax] = _t77;
				_push(E0060D4F8);
				E0040A228( &_v36, 4);
				return E0040A228( &_v12, 2);
			}
















                                                                                          0x0060d3b7
                                                                                          0x0060d3b9
                                                                                          0x0060d3ba
                                                                                          0x0060d3bb
                                                                                          0x0060d3bc
                                                                                          0x0060d3bd
                                                                                          0x0060d3be
                                                                                          0x0060d3bf
                                                                                          0x0060d3c0
                                                                                          0x0060d3c4
                                                                                          0x0060d3c7
                                                                                          0x0060d3cd
                                                                                          0x0060d3d4
                                                                                          0x0060d3d5
                                                                                          0x0060d3da
                                                                                          0x0060d3dd
                                                                                          0x0060d3e6
                                                                                          0x0060d3f1
                                                                                          0x0060d3fb
                                                                                          0x0060d3fd
                                                                                          0x0060d3ff
                                                                                          0x0060d403
                                                                                          0x0060d403
                                                                                          0x0060d40a
                                                                                          0x0060d40c
                                                                                          0x0060d40c
                                                                                          0x0060d40e
                                                                                          0x0060d410
                                                                                          0x0060d412
                                                                                          0x0060d418
                                                                                          0x0060d41d
                                                                                          0x0060d427
                                                                                          0x0060d42c
                                                                                          0x0060d436
                                                                                          0x0060d43b
                                                                                          0x0060d43b
                                                                                          0x0060d440
                                                                                          0x0060d443
                                                                                          0x0060d44d
                                                                                          0x0060d452
                                                                                          0x0060d455
                                                                                          0x0060d462
                                                                                          0x0060d471
                                                                                          0x0060d473
                                                                                          0x0060d47d
                                                                                          0x0060d484
                                                                                          0x0060d4a1
                                                                                          0x0060d4a9
                                                                                          0x0060d4ae
                                                                                          0x0060d4b1
                                                                                          0x0060d4b1
                                                                                          0x0060d4ae
                                                                                          0x0060d484
                                                                                          0x0060d4b6
                                                                                          0x0060d4c4
                                                                                          0x0060d4cb
                                                                                          0x0060d4ce
                                                                                          0x0060d4d1
                                                                                          0x0060d4de
                                                                                          0x0060d4f0

                                                                                          APIs
                                                                                          • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060D4F1), ref: 0060D4A1
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060D4F1), ref: 0060D4B1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFileHandle
                                                                                          • String ID: .tmp$Gtk$_iu
                                                                                          • API String ID: 3498533004-1320520068
                                                                                          • Opcode ID: d9923e9e397c465da7ce88f6dbc42c5aa1e8954d49b86fc7f7a3ecad4dc45759
                                                                                          • Instruction ID: 38fd5bd3aef28e796ac18a57f9f91bd27b67d48edde35eb58a18837c564f9665
                                                                                          • Opcode Fuzzy Hash: d9923e9e397c465da7ce88f6dbc42c5aa1e8954d49b86fc7f7a3ecad4dc45759
                                                                                          • Instruction Fuzzy Hash: 73319030E80209ABDB14EBE4C842BDEBBB5AF54308F118169E904B73D1D738AE458B55
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B8998 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 94%
                                                                                          			E006B8998(char __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr _t44;
				intOrPtr _t48;
				intOrPtr _t61;
				intOrPtr _t66;
				intOrPtr _t92;
				void* _t96;
				void* _t97;
				void* _t98;
				intOrPtr _t99;

				_t100 = __eflags;
				_t95 = __esi;
				_t94 = __edi;
				_t68 = __ebx;
				_t97 = _t98;
				_t99 = _t98 + 0xffffffdc;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				 *[fs:eax] = _t99;
				_t27 =  *0x6cdec4; // 0x6d579c
				E005B8250( *_t27, L"Uninstall", __eflags);
				_t30 =  *0x6cdec4; // 0x6d579c
				ShowWindow( *( *_t30 + 0x188), 5);
				 *[fs:edx] = _t99;
				E006AF824();
				E005C745C( &_v20);
				E00424020(_v20);
				E005C6FB0(0, __ebx,  &_v24, __edi, __esi);
				E0040A5A8(0x6d68d0, _v24);
				E006B6C80(__ebx, __edi, __esi, _t100);
				_t44 =  *0x6d68d0; // 0x0
				E005C4F90(_t44, _t68,  &_v28, L".dat", _t94, _t95);
				E0040A5A8(0x6d68d4, _v28);
				_t48 =  *0x6d68d0; // 0x0
				E005C4F90(_t48, _t68,  &_v32, L".msg", _t94, _t95);
				E0040A5A8(0x6d68d8, _v32);
				_v8 = E005CBFB8(1, 1, 0, 2);
				 *[fs:eax] = _t99;
				 *((intOrPtr*)( *_v8 + 4))( *[fs:eax], 0x6b8af0, _t97,  *[fs:edx], 0x6b8c15, _t97,  *[fs:eax], 0x6b8c4e, _t97, __edi, __esi, __ebx, _t96);
				E005CBF78(_v8, _v40 - 8);
				E005CBF50(_v8, 8,  &_v16);
				if(_v16 == 0x67734d49) {
					_t61 =  *0x6d68d0; // 0x0
					E005CD6BC(_t61, _t68, 1, _v12, _t94, _t95);
				} else {
					_t66 =  *0x6d68d8; // 0x0
					E005CD6BC(_t66, _t68, 1, 0, _t94, _t95);
				}
				_pop(_t92);
				 *[fs:eax] = _t92;
				_push(E006B8AF7);
				return E00408444(_v8);
			}






















                                                                                          0x006b8998
                                                                                          0x006b8998
                                                                                          0x006b8998
                                                                                          0x006b8998
                                                                                          0x006b8999
                                                                                          0x006b899b
                                                                                          0x006b89a3
                                                                                          0x006b89a6
                                                                                          0x006b89a9
                                                                                          0x006b89ac
                                                                                          0x006b89ba
                                                                                          0x006b89bd
                                                                                          0x006b89c9
                                                                                          0x006b89d0
                                                                                          0x006b89de
                                                                                          0x006b89ee
                                                                                          0x006b89f1
                                                                                          0x006b89f9
                                                                                          0x006b8a01
                                                                                          0x006b8a0b
                                                                                          0x006b8a18
                                                                                          0x006b8a1d
                                                                                          0x006b8a2a
                                                                                          0x006b8a2f
                                                                                          0x006b8a3c
                                                                                          0x006b8a49
                                                                                          0x006b8a4e
                                                                                          0x006b8a5b
                                                                                          0x006b8a78
                                                                                          0x006b8a86
                                                                                          0x006b8a91
                                                                                          0x006b8a9d
                                                                                          0x006b8aad
                                                                                          0x006b8ab9
                                                                                          0x006b8ad0
                                                                                          0x006b8ad5
                                                                                          0x006b8abb
                                                                                          0x006b8abf
                                                                                          0x006b8ac4
                                                                                          0x006b8ac4
                                                                                          0x006b8adc
                                                                                          0x006b8adf
                                                                                          0x006b8ae2
                                                                                          0x006b8aef

                                                                                          APIs
                                                                                            • Part of subcall function 005B8250: SetWindowTextW.USER32(?,00000000), ref: 005B8281
                                                                                          • ShowWindow.USER32(?,00000005,00000000,006B8C4E,?,?,00000000), ref: 006B89DE
                                                                                            • Part of subcall function 005C745C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C746F
                                                                                            • Part of subcall function 00424020: SetCurrentDirectoryW.KERNEL32(00000000,?,006B8A06,00000000,006B8C15,?,?,00000005,00000000,006B8C4E,?,?,00000000), ref: 0042402B
                                                                                            • Part of subcall function 005C6FB0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005C7045,?,?,?,00000001,?,0061037E,00000000,006103E9), ref: 005C6FE5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
                                                                                          • String ID: .dat$.msg$IMsg$Uninstall
                                                                                          • API String ID: 3312786188-1660910688
                                                                                          • Opcode ID: 63330379ee7d9b95b861f2c830674b3cbcb3c562fb0df0672f6e430388818c21
                                                                                          • Instruction ID: 43941ce92546cf1f75effb4615d96ab71b8b1f254b2d248514a95b56d5af6042
                                                                                          • Opcode Fuzzy Hash: 63330379ee7d9b95b861f2c830674b3cbcb3c562fb0df0672f6e430388818c21
                                                                                          • Instruction Fuzzy Hash: 65415CB0A002059FC700EFA4CD96E9EBBB6FB88304F51846AF400A7751DB75AE41DFA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006153AC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 94%
                                                                                          			E006153AC(struct HWND__* __eax, signed char __edx, void* __ebp) {
				char _v16;
				signed char _v20;
				char _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				struct HWND__* _t14;
				void* _t21;
				intOrPtr* _t22;
				struct HWND__* _t28;
				void* _t29;
				signed char* _t31;

				_t31 =  &_v20;
				 *_t31 = __edx;
				_t28 = __eax;
				_t21 = SendMessageW(__eax, 0xb06, 0, 0);
				if(_t21 != 0x6020000) {
					_v28 = _t21;
					_v24 = 0;
					_v20 = 0x6020000;
					_v16 = 0;
					_t23 = L"Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)";
					E00429044(_t21, L"Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)", 1, 0x6d62f8, _t28, 1,  &_v28);
					E004098C4();
				}
				 *0x6d62e4 = 1;
				 *0x6d62f4 = _t28;
				_t8 =  *0x615310; // 0x615368
				 *0x6d62f8 = E004785F8(E006158C4, _t8);
				if( *0x6d62f8 == 0) {
					E0060CD28(L"Failed to create DebugClientWnd", _t21);
				}
				_t29 = 4;
				_t22 =  *0x6cdb54; // 0x6cceb4
				do {
					E005C86E0( *0x6d62f8, _t23,  *_t22);
					_t22 = _t22 + 4;
					_t29 = _t29 - 1;
				} while (_t29 != 0);
				_t14 =  *0x6d62f4; // 0x0
				return SendMessageW(_t14, 0xb00,  *0x6d62f8,  *_t31 & 0x000000ff);
			}

















                                                                                          0x006153af
                                                                                          0x006153b2
                                                                                          0x006153b5
                                                                                          0x006153cb
                                                                                          0x006153d3
                                                                                          0x006153d5
                                                                                          0x006153d9
                                                                                          0x006153de
                                                                                          0x006153e6
                                                                                          0x006153f2
                                                                                          0x006153fe
                                                                                          0x00615403
                                                                                          0x00615403
                                                                                          0x00615408
                                                                                          0x0061540f
                                                                                          0x00615415
                                                                                          0x00615425
                                                                                          0x0061542a
                                                                                          0x00615431
                                                                                          0x00615431
                                                                                          0x00615436
                                                                                          0x0061543b
                                                                                          0x00615441
                                                                                          0x00615445
                                                                                          0x0061544a
                                                                                          0x0061544d
                                                                                          0x0061544d
                                                                                          0x0061545d
                                                                                          0x0061546e

                                                                                          APIs
                                                                                          • SendMessageW.USER32(00000000,00000B06,00000000,00000000), ref: 006153C6
                                                                                          • SendMessageW.USER32(00000000,00000B00,00000000,00000000), ref: 00615463
                                                                                          Strings
                                                                                          • Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 006153F2
                                                                                          • hSa, xrefs: 00615415
                                                                                          • Failed to create DebugClientWnd, xrefs: 0061542C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend
                                                                                          • String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd$hSa
                                                                                          • API String ID: 3850602802-2905362044
                                                                                          • Opcode ID: 2117e5ac0ad1040265e7c1df23ec1a92719b63b16dd021124f1a90b183fe0079
                                                                                          • Instruction ID: bd2b79d17f40968884fe1c372ced24de8c60c917dea0cb25488337d16b2a65e4
                                                                                          • Opcode Fuzzy Hash: 2117e5ac0ad1040265e7c1df23ec1a92719b63b16dd021124f1a90b183fe0079
                                                                                          • Instruction Fuzzy Hash: 391123B1A403129FE300EB28DC81FDABBD69F94304F08002AF5858B3D2D3749C84C766
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00624AA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 63%
                                                                                          			E00624AA4(HANDLE* __eax) {
				HANDLE* _v8;
				long _v12;
				intOrPtr* _t7;
				long _t11;
				intOrPtr _t27;
				void* _t30;

				_v8 = __eax;
				_push(_t30);
				_push(0x624b25);
				_push( *[fs:edx]);
				 *[fs:edx] = _t30 + 0xfffffff8;
				do {
					_t7 =  *0x6cdec4; // 0x6d579c
					E005B8704( *_t7);
					_t11 = MsgWaitForMultipleObjects(1, _v8, 0, 0xffffffff, 0x4ff);
				} while (_t11 == 1);
				if(_t11 == 0xffffffff) {
					E0060CE84(L"MsgWaitForMultipleObjects");
				}
				if(GetExitCodeProcess( *_v8,  &_v12) == 0) {
					E0060CE84(L"GetExitCodeProcess");
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(E00624B2C);
				return CloseHandle( *_v8);
			}









                                                                                          0x00624aaa
                                                                                          0x00624aaf
                                                                                          0x00624ab0
                                                                                          0x00624ab5
                                                                                          0x00624ab8
                                                                                          0x00624abb
                                                                                          0x00624abb
                                                                                          0x00624ac2
                                                                                          0x00624ad6
                                                                                          0x00624adb
                                                                                          0x00624ae3
                                                                                          0x00624aea
                                                                                          0x00624aea
                                                                                          0x00624b00
                                                                                          0x00624b07
                                                                                          0x00624b07
                                                                                          0x00624b0e
                                                                                          0x00624b11
                                                                                          0x00624b14
                                                                                          0x00624b24

                                                                                          APIs
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 00624AD6
                                                                                          • GetExitCodeProcess.KERNEL32 ref: 00624AF9
                                                                                          • CloseHandle.KERNEL32(?,00624B2C,00000001,00000000,000000FF,000004FF,00000000,00624B25), ref: 00624B1F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCodeExitHandleMultipleObjectsProcessWait
                                                                                          • String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
                                                                                          • API String ID: 2573145106-3235461205
                                                                                          • Opcode ID: 5a47b888b64c9d71a21df3ce652ab4a6790a840d61fbcb63caf85f52caaf36c3
                                                                                          • Instruction ID: b445045a4a45572890d55b61ba1fda7f57045845c9b5a3357f52015174d7dfc9
                                                                                          • Opcode Fuzzy Hash: 5a47b888b64c9d71a21df3ce652ab4a6790a840d61fbcb63caf85f52caaf36c3
                                                                                          • Instruction Fuzzy Hash: CE01A234640605AFD710EFA8ED62E9977EAEB49721F200265F520D73D0DE74ED44CA19
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004070B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004070B0(signed int __eax, void* __edx) {
				short _v530;
				short _v1052;
				short _v1056;
				short _v1058;
				signed int _t20;
				void* _t24;
				WCHAR* _t25;

				_t25 =  &_v1052;
				_t24 = __edx;
				_t20 = __eax;
				if(__eax != 0) {
					 *_t25 = (__eax & 0x000000ff) + 0x41 - 1;
					_v1058 = 0x3a;
					_v1056 = 0;
					GetCurrentDirectoryW(0x105,  &_v530);
					SetCurrentDirectoryW(_t25);
				}
				GetCurrentDirectoryW(0x105,  &_v1052);
				if(_t20 != 0) {
					SetCurrentDirectoryW( &_v530);
				}
				return E0040B318(_t24, 0x105,  &_v1052);
			}










                                                                                          0x004070b2
                                                                                          0x004070b8
                                                                                          0x004070ba
                                                                                          0x004070be
                                                                                          0x004070c8
                                                                                          0x004070cc
                                                                                          0x004070d3
                                                                                          0x004070e7
                                                                                          0x004070ed
                                                                                          0x004070ed
                                                                                          0x004070fc
                                                                                          0x00407103
                                                                                          0x0040710d
                                                                                          0x0040710d
                                                                                          0x0040712a

                                                                                          APIs
                                                                                          • GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 004070E7
                                                                                          • SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 004070ED
                                                                                          • GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 004070FC
                                                                                          • SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 0040710D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentDirectory
                                                                                          • String ID: :
                                                                                          • API String ID: 1611563598-336475711
                                                                                          • Opcode ID: 2426f4f7bef9f49da2292af32f708acef7ce6c3c0b0946d6af767bcaefb160ad
                                                                                          • Instruction ID: 4e46778bef482c884a40b6a77bd37b1cdf5980326a29a022de95e28d89e8e0a5
                                                                                          • Opcode Fuzzy Hash: 2426f4f7bef9f49da2292af32f708acef7ce6c3c0b0946d6af767bcaefb160ad
                                                                                          • Instruction Fuzzy Hash: 71F0627154474465D310E7658852BDB729CDF84348F04843E76C89B2D1E6BC5948979B
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0059BDE0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0059BDE0(int __eax, void* __edx) {
				void* __edi;
				void* __esi;
				signed int _t39;
				signed int _t40;
				intOrPtr _t44;
				int _t45;
				void* _t47;
				int _t48;
				intOrPtr* _t49;

				_t18 = __eax;
				_t49 = __eax;
				if(( *(__eax + 0x1c) & 0x00000008) == 0) {
					if(( *(__eax + 0x1c) & 0x00000002) != 0) {
						 *((char*)(__eax + 0x80)) = 1;
						return __eax;
					}
					_t19 =  *((intOrPtr*)(__eax + 0x78));
					if( *((intOrPtr*)(__eax + 0x78)) != 0) {
						return E0059BDE0(_t19, __edx);
					}
					_t18 = GetMenuItemCount(E0059BF18(__eax, _t45, _t47));
					_t48 = _t18;
					_t40 = _t39 & 0xffffff00 | _t48 == 0x00000000;
					while(_t48 > 0) {
						_t45 = _t48 - 1;
						_t18 = GetMenuState(E0059BF18(_t49, _t45, _t48), _t45, 0x400);
						if((_t18 & 0x00000004) == 0) {
							_t18 = RemoveMenu(E0059BF18(_t49, _t45, _t48), _t45, 0x400);
							_t40 = 1;
						}
						_t48 = _t48 - 1;
					}
					if(_t40 != 0) {
						if( *((intOrPtr*)(_t49 + 0x70)) != 0) {
							L14:
							E0059BC9C(_t49, _t45, _t48);
							L15:
							return  *((intOrPtr*)( *_t49 + 0x50))();
						}
						_t44 =  *0x59a1c4; // 0x59a21c
						if(E0040868C( *((intOrPtr*)(_t49 + 0x7c)), _t44) == 0 || GetMenuItemCount(E0059BF18(_t49, _t45, _t48)) != 0) {
							goto L14;
						} else {
							DestroyMenu( *(_t49 + 0xbc));
							 *(_t49 + 0xbc) = 0;
							goto L15;
						}
					}
				}
				return _t18;
			}












                                                                                          0x0059bde0
                                                                                          0x0059bde4
                                                                                          0x0059bdea
                                                                                          0x0059bdf4
                                                                                          0x0059bdf6
                                                                                          0x00000000
                                                                                          0x0059bdf6
                                                                                          0x0059be02
                                                                                          0x0059be07
                                                                                          0x00000000
                                                                                          0x0059be09
                                                                                          0x0059be1b
                                                                                          0x0059be20
                                                                                          0x0059be24
                                                                                          0x0059be29
                                                                                          0x0059be32
                                                                                          0x0059be3c
                                                                                          0x0059be43
                                                                                          0x0059be53
                                                                                          0x0059be58
                                                                                          0x0059be58
                                                                                          0x0059be5a
                                                                                          0x0059be5b
                                                                                          0x0059be61
                                                                                          0x0059be67
                                                                                          0x0059bea2
                                                                                          0x0059bea4
                                                                                          0x0059bea9
                                                                                          0x00000000
                                                                                          0x0059beaf
                                                                                          0x0059be6c
                                                                                          0x0059be79
                                                                                          0x00000000
                                                                                          0x0059be8c
                                                                                          0x0059be93
                                                                                          0x0059be9a
                                                                                          0x00000000
                                                                                          0x0059be9a
                                                                                          0x0059be79
                                                                                          0x0059be61
                                                                                          0x0059beb6

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ad8bebb6b70c684c30d9747228a5e3f8ffc0963a0edfe972ae4d2d3d4fc87c04
                                                                                          • Instruction ID: f6f51fa323c2004b4ed4a12cf3aa4c02228d8e81e9c13bd86265522dc6499af0
                                                                                          • Opcode Fuzzy Hash: ad8bebb6b70c684c30d9747228a5e3f8ffc0963a0edfe972ae4d2d3d4fc87c04
                                                                                          • Instruction Fuzzy Hash: B01172A160425956FF706A7A6F09BEA3F9C7FD1745F050429BE419B283CB38CC458BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B631C Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 92%
                                                                                          			E005B631C() {
				intOrPtr _v4;
				void* _v8;
				int _t5;
				void* _t6;
				intOrPtr _t12;
				struct HHOOK__* _t14;
				void* _t19;
				void* _t20;

				if( *0x6d57c0 != 0) {
					_t14 =  *0x6d57c0; // 0x0
					UnhookWindowsHookEx(_t14);
				}
				 *0x6d57c0 = 0;
				_v4 = 0x6d57c4;
				_t5 = 0;
				asm("lock xchg [edx], eax");
				_v8 = 0;
				if(_v8 != 0) {
					_t6 =  *0x6d57bc; // 0x0
					SetEvent(_t6);
					if(GetCurrentThreadId() !=  *0x6d57b8) {
						while(MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff) != 0) {
							_t12 =  *0x6d579c; // 0x24cbde0
							E005B871C(_t12, _t19, _t20);
						}
					}
					_t5 = CloseHandle(_v8);
				}
				return _t5;
			}











                                                                                          0x005b6326
                                                                                          0x005b6328
                                                                                          0x005b632e
                                                                                          0x005b632e
                                                                                          0x005b6335
                                                                                          0x005b633a
                                                                                          0x005b6346
                                                                                          0x005b6348
                                                                                          0x005b634b
                                                                                          0x005b6352
                                                                                          0x005b6354
                                                                                          0x005b635a
                                                                                          0x005b636a
                                                                                          0x005b6378
                                                                                          0x005b636e
                                                                                          0x005b6373
                                                                                          0x005b6373
                                                                                          0x005b6378
                                                                                          0x005b6395
                                                                                          0x005b6395
                                                                                          0x005b639c

                                                                                          APIs
                                                                                          • UnhookWindowsHookEx.USER32(00000000), ref: 005B632E
                                                                                          • SetEvent.KERNEL32(00000000), ref: 005B635A
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 005B635F
                                                                                          • MsgWaitForMultipleObjects.USER32 ref: 005B6388
                                                                                          • CloseHandle.KERNEL32(00000000,00000000), ref: 005B6395
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCurrentEventHandleHookMultipleObjectsThreadUnhookWaitWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2132507429-0
                                                                                          • Opcode ID: 3d70fa8801357980af144d8f96a13d0436440f37400d9bd4b324e4fa6e60107c
                                                                                          • Instruction ID: 777aa0f60006170efd8bf97b8faec0e2cbbea874aebe53a0ac6f8c30ff2fdbbe
                                                                                          • Opcode Fuzzy Hash: 3d70fa8801357980af144d8f96a13d0436440f37400d9bd4b324e4fa6e60107c
                                                                                          • Instruction Fuzzy Hash: 30018B70A09700EED700EB65DC45BAE37E9FB44715F604A2AF055C75D0DB38A480CB42
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00409EF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E00409EF0() {
				intOrPtr* _t14;
				void* _t23;
				void* _t26;
				intOrPtr _t34;
				intOrPtr* _t36;
				void* _t50;
				struct HINSTANCE__* _t53;
				void* _t62;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x6c5004 != 0) {
					E00409DD8();
					E00409E60(_t50);
					 *0x6c5004 = 0;
				}
				if( *0x6d1bd0 != 0 && GetCurrentThreadId() ==  *0x6d1bf8) {
					L00409B30(0x6d1bcc);
					E00409E34(0x6d1bcc);
				}
				if( *0x006D1BC4 != 0 ||  *0x6cf058 == 0) {
					L9:
					if( *((char*)(0x6d1bc4)) == 2 &&  *0x6c5000 == 0) {
						 *0x006D1BA8 = 0;
					}
					if( *((char*)(0x6d1bc4)) != 0) {
						L15:
						E00409B58();
						if( *((char*)(0x6d1bc4)) <= 1 ||  *0x6c5000 != 0) {
							_t18 =  *0x006D1BAC;
							if( *0x006D1BAC != 0) {
								E0040EBB8(_t18);
								_t34 =  *((intOrPtr*)(0x6d1bac));
								_t8 = _t34 + 0x10; // 0x400000
								_t53 =  *_t8;
								_t9 = _t34 + 4; // 0x400000
								if(_t53 !=  *_t9 && _t53 != 0) {
									FreeLibrary(_t53);
								}
							}
						}
						L00409B30(0x6d1b9c);
						if( *((char*)(0x6d1bc4)) == 1) {
							 *0x006D1BC0();
						}
						if( *((char*)(0x6d1bc4)) != 0) {
							E00409E34(0x6d1b9c);
						}
						if( *0x6d1b9c == 0) {
							if( *0x6cf038 != 0) {
								 *0x6cf038();
							}
							ExitProcess( *0x6c5000);
						}
						memcpy(0x6d1b9c,  *0x6d1b9c, 0xc << 2);
						_t62 = _t62 + 0xc;
						0x6c5000 = 0x6c5000;
						0x6d1b9c = 0x6d1b9c;
						goto L9;
					} else {
						_t23 = E00406FD0();
						_t48 = _t23;
						if(_t23 == 0) {
							goto L15;
						} else {
							goto L14;
						}
						do {
							L14:
							E00408444(_t48);
							_t26 = E00406FD0();
							_t48 = _t26;
						} while (_t26 != 0);
						goto L15;
					}
				} else {
					do {
						_t36 =  *0x6cf058; // 0x422168
						 *0x6cf058 = 0;
						 *_t36();
					} while ( *0x6cf058 != 0);
					L9:
					while(1) {
					}
				}
			}











                                                                                          0x00409ef2
                                                                                          0x00409f0c
                                                                                          0x00409f0e
                                                                                          0x00409f13
                                                                                          0x00409f1a
                                                                                          0x00409f1a
                                                                                          0x00409f26
                                                                                          0x00409f3a
                                                                                          0x00409f44
                                                                                          0x00409f44
                                                                                          0x00409f4d
                                                                                          0x00409f71
                                                                                          0x00409f75
                                                                                          0x00409f7e
                                                                                          0x00409f7e
                                                                                          0x00409f85
                                                                                          0x00409fa4
                                                                                          0x00409fa4
                                                                                          0x00409fad
                                                                                          0x00409fb4
                                                                                          0x00409fb9
                                                                                          0x00409fbb
                                                                                          0x00409fc0
                                                                                          0x00409fc3
                                                                                          0x00409fc3
                                                                                          0x00409fc6
                                                                                          0x00409fc9
                                                                                          0x00409fd0
                                                                                          0x00409fd0
                                                                                          0x00409fc9
                                                                                          0x00409fb9
                                                                                          0x00409fd7
                                                                                          0x00409fe0
                                                                                          0x00409fe2
                                                                                          0x00409fe2
                                                                                          0x00409fe9
                                                                                          0x00409fed
                                                                                          0x00409fed
                                                                                          0x00409ff5
                                                                                          0x00409ffe
                                                                                          0x0040a000
                                                                                          0x0040a000
                                                                                          0x0040a009
                                                                                          0x0040a009
                                                                                          0x0040a01b
                                                                                          0x0040a01b
                                                                                          0x0040a01d
                                                                                          0x0040a01e
                                                                                          0x00000000
                                                                                          0x00409f87
                                                                                          0x00409f87
                                                                                          0x00409f8c
                                                                                          0x00409f90
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00409f92
                                                                                          0x00409f92
                                                                                          0x00409f94
                                                                                          0x00409f99
                                                                                          0x00409f9e
                                                                                          0x00409fa0
                                                                                          0x00000000
                                                                                          0x00409f92
                                                                                          0x00409f58
                                                                                          0x00409f58
                                                                                          0x00409f58
                                                                                          0x00409f61
                                                                                          0x00409f66
                                                                                          0x00409f68
                                                                                          0x00000000
                                                                                          0x00409f71
                                                                                          0x00000000
                                                                                          0x00409f71

                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00409F28
                                                                                          • FreeLibrary.KERNEL32(00400000), ref: 00409FD0
                                                                                          • ExitProcess.KERNEL32(00000000), ref: 0040A009
                                                                                            • Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409E99
                                                                                            • Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409E9F
                                                                                            • Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409EBA
                                                                                            • Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000), ref: 00409EC0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
                                                                                          • String ID: h!B
                                                                                          • API String ID: 3490077880-2915595989
                                                                                          • Opcode ID: 6e2091dca20270f8a20cf8cc11afaa586328623b61bba081a6e7934708d226d6
                                                                                          • Instruction ID: f9b39a6b7fda091489343637b553fd19e8af48d587eef7151bf6213efad78fdc
                                                                                          • Opcode Fuzzy Hash: 6e2091dca20270f8a20cf8cc11afaa586328623b61bba081a6e7934708d226d6
                                                                                          • Instruction Fuzzy Hash: 5A316D20A007828AD721AB7A9494B2777E26F45328F14043FE449E72E3D7BCDC84C75A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B8F64 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 84%
                                                                                          			E006B8F64(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				WCHAR* _t43;
				char _t58;
				intOrPtr _t68;
				void* _t72;
				signed int _t74;
				void* _t78;

				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v20 = __edx;
				_v16 = __eax;
				_push(_t78);
				_push(0x6b9062);
				_push( *[fs:eax]);
				 *[fs:eax] = _t78 + 0xffffffe4;
				E0040A1C8(_v20);
				E005C5428(_v16, 0,  &_v8);
				_t72 = 0;
				_t58 = 0;
				do {
					_v32 = _t58;
					_v28 = 0;
					E004244F8(L"isRS-%.3u.tmp", 0,  &_v32,  &_v24);
					E0040B4C8( &_v12, _v24, _v8);
					_t74 = GetFileAttributesW(E0040B278(_v12));
					if(_t74 == 0xffffffff) {
						L5:
						_t43 = E0040B278(_v12);
						if(MoveFileExW(E0040B278(_v16), _t43, 1) == 0) {
							_t72 = _t72 + 1;
							if(_t72 == 0xa) {
								break;
							}
							goto L8;
						}
						E0040A5A8(_v20, _v12);
						break;
					}
					if((_t74 & 0x00000010) != 0) {
						goto L8;
					}
					if((_t74 & 0x00000001) != 0) {
						SetFileAttributesW(E0040B278(_v12), _t74 & 0xfffffffe);
					}
					goto L5;
					L8:
					_t58 = _t58 + 1;
				} while (_t58 != 0x3e8);
				_pop(_t68);
				 *[fs:eax] = _t68;
				_push(E006B9069);
				E0040A1C8( &_v24);
				return E0040A228( &_v12, 2);
			}
















                                                                                          0x006b8f6f
                                                                                          0x006b8f72
                                                                                          0x006b8f75
                                                                                          0x006b8f78
                                                                                          0x006b8f7b
                                                                                          0x006b8f80
                                                                                          0x006b8f81
                                                                                          0x006b8f86
                                                                                          0x006b8f89
                                                                                          0x006b8f8f
                                                                                          0x006b8f9a
                                                                                          0x006b8f9f
                                                                                          0x006b8fa1
                                                                                          0x006b8fa3
                                                                                          0x006b8fa7
                                                                                          0x006b8faa
                                                                                          0x006b8fb8
                                                                                          0x006b8fc6
                                                                                          0x006b8fd9
                                                                                          0x006b8fde
                                                                                          0x006b9002
                                                                                          0x006b9007
                                                                                          0x006b901d
                                                                                          0x006b902c
                                                                                          0x006b9030
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006b9030
                                                                                          0x006b9025
                                                                                          0x00000000
                                                                                          0x006b9025
                                                                                          0x006b8fe6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006b8fee
                                                                                          0x006b8ffd
                                                                                          0x006b8ffd
                                                                                          0x00000000
                                                                                          0x006b9032
                                                                                          0x006b9032
                                                                                          0x006b9033
                                                                                          0x006b9041
                                                                                          0x006b9044
                                                                                          0x006b9047
                                                                                          0x006b904f
                                                                                          0x006b9061

                                                                                          APIs
                                                                                          • GetFileAttributesW.KERNEL32(00000000,006C46F1,00000000,006B9062,?,?,006D579C,?,00000000,00000000,?,006B9494,00000000,006B949E,?,00000000), ref: 006B8FD4
                                                                                          • SetFileAttributesW.KERNEL32(00000000,00000000,00000000,006C46F1,00000000,006B9062,?,?,006D579C,?,00000000,00000000,?,006B9494,00000000,006B949E), ref: 006B8FFD
                                                                                          • MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,006C46F1,00000000,006B9062,?,?,006D579C,?,00000000,00000000,?,006B9494,00000000), ref: 006B9016
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$Attributes$Move
                                                                                          • String ID: isRS-%.3u.tmp
                                                                                          • API String ID: 3839737484-3657609586
                                                                                          • Opcode ID: b23dff8f6bd12a639b1b1c4206b26ebe3b9b0ab8f8669d0e19c3f05edbd621a2
                                                                                          • Instruction ID: 31d351f3c97924346b89867796ea0414510024315a00da88274a448b23120628
                                                                                          • Opcode Fuzzy Hash: b23dff8f6bd12a639b1b1c4206b26ebe3b9b0ab8f8669d0e19c3f05edbd621a2
                                                                                          • Instruction Fuzzy Hash: AB318170D04218ABCB00EBB9C8859EEB7B9EF48314F51467EF814B7281D7385E818769
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B6998 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 55%
                                                                                          			E006B6998(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				struct _STARTUPINFOW _v76;
				struct _PROCESS_INFORMATION _v92;
				int _t22;
				intOrPtr _t28;
				intOrPtr _t41;
				void* _t47;

				_v8 = 0;
				_t44 = __edx;
				_t32 = __eax;
				_push(_t47);
				_push(0x6b6a40);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47 + 0xffffffa8;
				_push(0x6b6a5c);
				_push(__eax);
				_push(E006B6A6C);
				_push(__edx);
				E0040B550( &_v8, __eax, 4, __edi, __edx);
				E00407760( &_v76, 0x44);
				_v76.cb = 0x44;
				_t22 = CreateProcessW(0, E0040B278(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92);
				_t49 = _t22;
				if(_t22 == 0) {
					_t28 =  *0x6cded8; // 0x6d5c28
					_t8 = _t28 + 0x20c; // 0x245b244
					E006B68EC( *_t8, _t32, 0, _t44, _t49);
				}
				CloseHandle(_v92.hThread);
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E006B6A47);
				return E0040A1C8( &_v8);
			}










                                                                                          0x006b69a2
                                                                                          0x006b69a5
                                                                                          0x006b69a7
                                                                                          0x006b69ab
                                                                                          0x006b69ac
                                                                                          0x006b69b1
                                                                                          0x006b69b4
                                                                                          0x006b69b7
                                                                                          0x006b69bc
                                                                                          0x006b69bd
                                                                                          0x006b69c2
                                                                                          0x006b69cb
                                                                                          0x006b69da
                                                                                          0x006b69df
                                                                                          0x006b6a05
                                                                                          0x006b6a0a
                                                                                          0x006b6a0c
                                                                                          0x006b6a0e
                                                                                          0x006b6a13
                                                                                          0x006b6a19
                                                                                          0x006b6a19
                                                                                          0x006b6a22
                                                                                          0x006b6a2c
                                                                                          0x006b6a2f
                                                                                          0x006b6a32
                                                                                          0x006b6a3f

                                                                                          APIs
                                                                                          • CreateProcessW.KERNEL32 ref: 006B6A05
                                                                                          • CloseHandle.KERNEL32(006B6AB0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,006B6A6C,?,006B6A5C,00000000), ref: 006B6A22
                                                                                            • Part of subcall function 006B68EC: GetLastError.KERNEL32(00000000,006B6989,?,?,?), ref: 006B690F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateErrorHandleLastProcess
                                                                                          • String ID: (\m$D
                                                                                          • API String ID: 3798668922-1981685662
                                                                                          • Opcode ID: 0393d074f231241aa5918641fa9e17eaa67b4a0688e7b4abcbc38b8408152389
                                                                                          • Instruction ID: 5a29f4a3f67f8962990b16f59edcecd6c92ec2fdb2b6e45770094aa6b13b7383
                                                                                          • Opcode Fuzzy Hash: 0393d074f231241aa5918641fa9e17eaa67b4a0688e7b4abcbc38b8408152389
                                                                                          • Instruction Fuzzy Hash: 53115EB1604248AFDB00EBA5CC92EEE77ADEF08704F51407AF505F7281E678AE448768
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0062460C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 48%
                                                                                          			E0062460C(void* __eax, void* __ebx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				void* _t19;
				char _t20;
				void* _t34;
				intOrPtr _t39;
				intOrPtr _t45;

				_t42 = __esi;
				_push(0);
				_push(0);
				_push(0);
				_push(_t45);
				_push(0x6246a6);
				 *[fs:eax] = _t45;
				E005C52C8(__eax,  &_v16, _t45,  *[fs:eax]);
				E0040B368( &_v8, _v16);
				_push(E0040EC28( &_v12));
				_t19 = E0040AEF4(_v8);
				_t34 = _t19;
				_push(_t34);
				L0043C244();
				if(_t19 != 0) {
					E0060CE98(L"LoadTypeLib", _t34, _t19, __esi);
				}
				_push(0);
				_push(_t34);
				_t20 = _v12;
				_push(_t20);
				L0043C24C();
				if(_t20 != 0) {
					E0060CE98(L"RegisterTypeLib", _t34, _t20, _t42);
				}
				_pop(_t39);
				 *[fs:eax] = _t39;
				_push(E006246AD);
				E0040A1C8( &_v16);
				E0040EC28( &_v12);
				return E0040A210( &_v8);
			}











                                                                                          0x0062460c
                                                                                          0x0062460f
                                                                                          0x00624611
                                                                                          0x00624613
                                                                                          0x0062461a
                                                                                          0x0062461b
                                                                                          0x00624623
                                                                                          0x0062462b
                                                                                          0x00624636
                                                                                          0x00624643
                                                                                          0x00624647
                                                                                          0x0062464c
                                                                                          0x0062464e
                                                                                          0x0062464f
                                                                                          0x00624656
                                                                                          0x0062465f
                                                                                          0x0062465f
                                                                                          0x00624664
                                                                                          0x00624666
                                                                                          0x00624667
                                                                                          0x0062466a
                                                                                          0x0062466b
                                                                                          0x00624672
                                                                                          0x0062467b
                                                                                          0x0062467b
                                                                                          0x00624682
                                                                                          0x00624685
                                                                                          0x00624688
                                                                                          0x00624690
                                                                                          0x00624698
                                                                                          0x006246a5

                                                                                          APIs
                                                                                            • Part of subcall function 005C52C8: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,006D579C,00000000,0060D8F7,00000000,0060DBD2,?,?,006D579C), ref: 005C52F9
                                                                                          • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0062464F
                                                                                          • RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 0062466B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Type$FullLoadNamePathRegister
                                                                                          • String ID: LoadTypeLib$RegisterTypeLib
                                                                                          • API String ID: 4170313675-2435364021
                                                                                          • Opcode ID: 7642341445ff506be6e38c2a38c0c863b89c51384ff79f3ea1c5a1c644a66b7a
                                                                                          • Instruction ID: a0643c8b31b351ed7dd0ed5e96a0399ab73b0cd2583ebe073036f576505b33dd
                                                                                          • Opcode Fuzzy Hash: 7642341445ff506be6e38c2a38c0c863b89c51384ff79f3ea1c5a1c644a66b7a
                                                                                          • Instruction Fuzzy Hash: 2D0148317407146BDB10EBB6DC82F8E77EDDB49704F514876B400F62D2DE78AE058A58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0042E20C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 80%
                                                                                          			E0042E20C(int __ecx, void* __edx, char _a4, intOrPtr _a8) {
				char _v24;
				void* __ebp;
				void* _t14;
				intOrPtr _t20;
				void* _t23;
				void* _t29;
				int _t30;
				intOrPtr _t31;
				void* _t32;
				void* _t34;
				void* _t35;
				void* _t36;
				int _t40;

				_t32 = __edx;
				_t30 = __ecx;
				if(__edx != 0) {
					_t36 = _t36 + 0xfffffff0;
					_t14 = E00408A40(_t14, _t35);
				}
				_t29 = _t32;
				_t34 = _t14;
				if(_t30 != 0) {
					 *(_t34 + 0xc) = _t30;
				} else {
					 *(_t34 + 0xc) = GetACP();
				}
				 *((intOrPtr*)(_t34 + 0x10)) = _a8;
				_t5 =  &_a4; // 0x46e824
				 *((intOrPtr*)(_t34 + 0x14)) =  *_t5;
				_t7 =  &_v24; // 0x42e125
				_t8 = _t34 + 0xc; // 0x42e30c
				_t40 = GetCPInfo( *_t8, _t7);
				if(_t40 == 0) {
					_t31 =  *0x6cdf2c; // 0x4154c0
					E004290C4(_t31, 1);
					E004098C4();
				}
				_t9 =  &_v24; // 0x42e125
				_t20 =  *_t9;
				 *((intOrPtr*)(_t34 + 8)) = _t20;
				 *((char*)(_t34 + 4)) = _t20 - 0x00000001 & 0xffffff00 | _t40 == 0x00000000;
				_t23 = _t34;
				if(_t29 != 0) {
					E00408A98(_t23);
					_pop( *[fs:0x0]);
				}
				return _t34;
			}
















                                                                                          0x0042e20c
                                                                                          0x0042e20c
                                                                                          0x0042e216
                                                                                          0x0042e218
                                                                                          0x0042e21b
                                                                                          0x0042e21b
                                                                                          0x0042e220
                                                                                          0x0042e222
                                                                                          0x0042e226
                                                                                          0x0042e232
                                                                                          0x0042e228
                                                                                          0x0042e22d
                                                                                          0x0042e22d
                                                                                          0x0042e238
                                                                                          0x0042e23b
                                                                                          0x0042e23e
                                                                                          0x0042e241
                                                                                          0x0042e245
                                                                                          0x0042e24e
                                                                                          0x0042e250
                                                                                          0x0042e252
                                                                                          0x0042e25f
                                                                                          0x0042e264
                                                                                          0x0042e264
                                                                                          0x0042e269
                                                                                          0x0042e269
                                                                                          0x0042e26c
                                                                                          0x0042e273
                                                                                          0x0042e276
                                                                                          0x0042e27a
                                                                                          0x0042e27c
                                                                                          0x0042e281
                                                                                          0x0042e288
                                                                                          0x0042e292

                                                                                          APIs
                                                                                          • GetACP.KERNEL32(004213C8,00000001), ref: 0042E228
                                                                                          • GetCPInfo.KERNEL32(0042E30C,%BF,004213C8,00000001), ref: 0042E249
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Info
                                                                                          • String ID: $F$%BF
                                                                                          • API String ID: 1807457897-1213976744
                                                                                          • Opcode ID: a0b4f71278cbe881e4ca83559b7bd4021c14457bcb40ec346197c5fc64764303
                                                                                          • Instruction ID: 1f83107e1eeb7a5b97efb5f655ff368bf58d4a69870ac0221b3df8472eb2f9c5
                                                                                          • Opcode Fuzzy Hash: a0b4f71278cbe881e4ca83559b7bd4021c14457bcb40ec346197c5fc64764303
                                                                                          • Instruction Fuzzy Hash: 0801C472B01605CBC720EFAAE441997B7E8AB04754B00853FE89AC7741EA39A9048BA5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060DAE9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 71%
                                                                                          			E0060DAE9(void* __edx) {
				WCHAR* _t13;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t36;

				SetFileAttributesW(E0040B278( *((intOrPtr*)(_t36 - 0x10))), 0x20);
				if(E00423A20( *((intOrPtr*)(_t36 - 0x10))) == 0) {
					E0060CE84(L"DeleteFile");
				}
				_t13 = E0040B278( *((intOrPtr*)(_t36 - 0x10)));
				if(MoveFileW(E0040B278( *((intOrPtr*)(_t36 - 0x14))), _t13) == 0) {
					E0060CE84(L"MoveFile");
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_pop(_t33);
				 *[fs:eax] = _t33;
				_push(E0060DBD9);
				E0040A228(_t36 - 0x44, 7);
				return E0040A228(_t36 - 0x1c, 7);
			}







                                                                                          0x0060daf4
                                                                                          0x0060db03
                                                                                          0x0060db0a
                                                                                          0x0060db0a
                                                                                          0x0060db12
                                                                                          0x0060db28
                                                                                          0x0060db2f
                                                                                          0x0060db2f
                                                                                          0x0060db36
                                                                                          0x0060db39
                                                                                          0x0060dbac
                                                                                          0x0060dbaf
                                                                                          0x0060dbb2
                                                                                          0x0060dbbf
                                                                                          0x0060dbd1

                                                                                          APIs
                                                                                          • SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0060DAF4
                                                                                            • Part of subcall function 00423A20: DeleteFileW.KERNEL32(00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A30
                                                                                            • Part of subcall function 00423A20: GetLastError.KERNEL32(00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A3F
                                                                                            • Part of subcall function 00423A20: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000,00000000), ref: 00423A47
                                                                                            • Part of subcall function 00423A20: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,006D579C,?,006B9479,00000000,006B94CE,?,?,00000005,?,00000000,00000000), ref: 00423A62
                                                                                          • MoveFileW.KERNEL32(00000000,00000000), ref: 0060DB21
                                                                                            • Part of subcall function 0060CE84: GetLastError.KERNEL32(00000000,0060DBAA,00000005,00000000,0060DBD2,?,?,006D579C,?,00000000,00000000,00000000,?,006B910F,00000000,006B912A), ref: 0060CE87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$AttributesErrorLast$DeleteDirectoryMoveRemove
                                                                                          • String ID: DeleteFile$MoveFile
                                                                                          • API String ID: 3947864702-139070271
                                                                                          • Opcode ID: bc8d32eb48fb5b1138ff79c324c24acff1ffb6ad42e273958a7328fc1a0bdacf
                                                                                          • Instruction ID: fe212bc12655be3e3d7d94ed230904773b29f806c55adb2c37bf9887ca86c235
                                                                                          • Opcode Fuzzy Hash: bc8d32eb48fb5b1138ff79c324c24acff1ffb6ad42e273958a7328fc1a0bdacf
                                                                                          • Instruction Fuzzy Hash: 62F044706841058AEB08FBF6E9069AF73A5EF44318F51467EF404E72C1DA3C9C05862D
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00626F48 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00626F48(signed int __eax, void* __ecx, void* __edx, void* __ebp) {
				void* _v16;
				void* __ebx;
				void* _t31;
				signed int _t33;

				_push(__ecx);
				_t31 = __edx;
				_t22 = __eax;
				_t33 = __eax & 0x0000007f;
				if( *((intOrPtr*)(0x6d6374 + _t33 * 4)) == 0) {
					if(E005C7A14(__eax, L"SOFTWARE\\Microsoft\\.NETFramework", 0x80000002,  &_v16, 1, 0) == 0) {
						E005C793C();
						RegCloseKey(_v16);
					}
					if( *((intOrPtr*)(0x6d6374 + _t33 * 4)) == 0) {
						E0060CD28(L".NET Framework not found", _t22);
					}
				}
				return E0040A5A8(_t31,  *((intOrPtr*)(0x6d6374 + _t33 * 4)));
			}







                                                                                          0x00626f4b
                                                                                          0x00626f4c
                                                                                          0x00626f4e
                                                                                          0x00626f52
                                                                                          0x00626f5d
                                                                                          0x00626f7b
                                                                                          0x00626f8c
                                                                                          0x00626f95
                                                                                          0x00626f95
                                                                                          0x00626fa2
                                                                                          0x00626fa9
                                                                                          0x00626fa9
                                                                                          0x00626fa2
                                                                                          0x00626fc0

                                                                                          APIs
                                                                                            • Part of subcall function 005C7A14: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005C80EE,?,00000000,?,005C808E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C80EE), ref: 005C7A30
                                                                                          • RegCloseKey.ADVAPI32(00000000,?,00000001,00000000,00000003,00626DA0,00000003,00000000,006270EB,00000000,006272A5,?,00626DA0,?,00000000,00000000), ref: 00626F95
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
                                                                                          • API String ID: 47109696-2631785700
                                                                                          • Opcode ID: 6b0c141a78bc874c544a1ceb02110ea20a9662452cb5153121f10ab642073d80
                                                                                          • Instruction ID: de5110e5fa14fd350821f7972f2051635d336fb801c9b7b6397190480774c976
                                                                                          • Opcode Fuzzy Hash: 6b0c141a78bc874c544a1ceb02110ea20a9662452cb5153121f10ab642073d80
                                                                                          • Instruction Fuzzy Hash: 48F0FF31B05524AFEB10EB49FC41B5A6B9BDB85310F50213AF184C3281E631DC018BA2
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C86E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 47%
                                                                                          			E005C86E0(void* __eax, void* __ecx, void* __edx) {
				void* __ebx;
				void* __esi;
				void* _t3;
				void* _t7;
				void* _t12;
				intOrPtr* _t13;

				_t8 = __ecx;
				_push(__ecx);
				_t7 = __edx;
				_t12 = __eax;
				if( *0x6d57f0 == 0) {
					 *0x6d57f4 = E00414020(_t7, _t12, GetModuleHandleW(L"user32.dll"), L"ChangeWindowMessageFilterEx");
					 *_t13 = 0x6d57f0;
					asm("lock xchg [edx], eax");
				}
				if( *0x6d57f4 == 0) {
					_t3 = E005C8644(_t7, _t8);
				} else {
					_t3 =  *0x6d57f4(_t12, _t7, 1, 0);
				}
				return _t3;
			}









                                                                                          0x005c86e0
                                                                                          0x005c86e2
                                                                                          0x005c86e3
                                                                                          0x005c86e5
                                                                                          0x005c86ee
                                                                                          0x005c8705
                                                                                          0x005c870a
                                                                                          0x005c8719
                                                                                          0x005c8719
                                                                                          0x005c8723
                                                                                          0x005c8735
                                                                                          0x005c8725
                                                                                          0x005c872b
                                                                                          0x005c872b
                                                                                          0x005c873d

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,?,00000004,006CCEB4,0061544A,006158C4,00615368,00000000,00000B06,00000000,00000000), ref: 005C86FA
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                            • Part of subcall function 005C8644: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005C873A,?,00000004,006CCEB4,0061544A,006158C4,00615368,00000000,00000B06,00000000,00000000), ref: 005C865B
                                                                                          • ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,?,00000004,006CCEB4,0061544A,006158C4,00615368,00000000,00000B06,00000000,00000000), ref: 005C872B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: HandleModule$AddressChangeFilterMessageProcWindow
                                                                                          • String ID: ChangeWindowMessageFilterEx$user32.dll
                                                                                          • API String ID: 989041661-2676053874
                                                                                          • Opcode ID: 069d2c8e1b8fc22a779199f9f95faad227b90f375a0982a66332104caa2a493e
                                                                                          • Instruction ID: 33574298acf09a9ab3b8dc906f6acd80ea038e69245e9512450f7745a5549cab
                                                                                          • Opcode Fuzzy Hash: 069d2c8e1b8fc22a779199f9f95faad227b90f375a0982a66332104caa2a493e
                                                                                          • Instruction Fuzzy Hash: F7F0A070702610DFD715EBA9AC89F662FE6EB84345F30142EF1069B691DBB60880C699
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004698FC Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 84%
                                                                                          			E004698FC(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, void* _a4, signed short _a8) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _t30;
				void* _t67;
				void* _t68;
				intOrPtr _t73;
				intOrPtr _t77;
				char _t78;
				intOrPtr _t82;
				signed short _t93;
				void* _t96;
				void* _t98;
				void* _t99;
				intOrPtr _t100;

				_t78 = __edx;
				_t68 = __ecx;
				_t98 = _t99;
				_t100 = _t99 + 0xffffffdc;
				_v36 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				if(__edx != 0) {
					_t100 = _t100 + 0xfffffff0;
					_t30 = E00408A40(_t30, _t98);
				}
				_t96 = _t68;
				_v5 = _t78;
				_t67 = _t30;
				_t93 = _a8;
				_push(_t98);
				_push(0x469a4c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t100;
				if((0x0000ff00 & _t93) != 0xff00) {
					E0046976C(E004236A4(_t96, _t93 & 0x0000ffff), 0);
					if( *((intOrPtr*)(_t67 + 4)) == 0xffffffff) {
						E00423BD0(_t96,  &_v36);
						_v24 = _v36;
						_v20 = 0x11;
						E00427D54(GetLastError(), _t67, 0, _t96);
						_v16 = _v40;
						_v12 = 0x11;
						_t73 =  *0x6cd8a8; // 0x415564
						E00429100(_t67, _t73, 1, _t93, _t96, 1,  &_v24);
						E004098C4();
					}
				} else {
					_t94 = _t93 & 0x000000ff;
					if((_t93 & 0x000000ff) == 0xff) {
						_t94 = 0x10;
					}
					E0046976C(E004236FC(_t96, _t94 & 0x0000ffff), 0);
					if( *((intOrPtr*)(_t67 + 4)) == 0xffffffff) {
						E00423BD0(_t96,  &_v28);
						_v24 = _v28;
						_v20 = 0x11;
						E00427D54(GetLastError(), _t67, 0, _t96);
						_v16 = _v32;
						_v12 = 0x11;
						_t77 =  *0x6ce1a8; // 0x41555c
						E00429100(_t67, _t77, 1, _t94, _t96, 1,  &_v24);
						E004098C4();
					}
				}
				_t28 = _t67 + 8; // 0x443d54
				E0040A5A8(_t28, _t96);
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E00469A53);
				return E0040A228( &_v40, 4);
			}
























                                                                                          0x004698fc
                                                                                          0x004698fc
                                                                                          0x004698fd
                                                                                          0x004698ff
                                                                                          0x00469907
                                                                                          0x0046990a
                                                                                          0x0046990d
                                                                                          0x00469910
                                                                                          0x00469915
                                                                                          0x00469917
                                                                                          0x0046991a
                                                                                          0x0046991a
                                                                                          0x0046991f
                                                                                          0x00469921
                                                                                          0x00469924
                                                                                          0x00469926
                                                                                          0x0046992b
                                                                                          0x0046992c
                                                                                          0x00469931
                                                                                          0x00469934
                                                                                          0x00469942
                                                                                          0x004699d2
                                                                                          0x004699db
                                                                                          0x004699e2
                                                                                          0x004699ea
                                                                                          0x004699ed
                                                                                          0x004699fb
                                                                                          0x00469a03
                                                                                          0x00469a06
                                                                                          0x00469a10
                                                                                          0x00469a1d
                                                                                          0x00469a22
                                                                                          0x00469a22
                                                                                          0x00469944
                                                                                          0x00469944
                                                                                          0x0046994e
                                                                                          0x00469950
                                                                                          0x00469950
                                                                                          0x00469967
                                                                                          0x00469970
                                                                                          0x0046997b
                                                                                          0x00469983
                                                                                          0x00469986
                                                                                          0x00469994
                                                                                          0x0046999c
                                                                                          0x0046999f
                                                                                          0x004699a9
                                                                                          0x004699b6
                                                                                          0x004699bb
                                                                                          0x004699bb
                                                                                          0x00469970
                                                                                          0x00469a27
                                                                                          0x00469a2c
                                                                                          0x00469a33
                                                                                          0x00469a36
                                                                                          0x00469a39
                                                                                          0x00469a4b

                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,00469A4C,?,?,00443D4C,00000001), ref: 0046998A
                                                                                            • Part of subcall function 004236A4: CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,00443D4C,004699CC,00000000,00469A4C,?,?,00443D4C), ref: 004236F3
                                                                                            • Part of subcall function 00423BD0: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,?,?,00443D4C,004699E7,00000000,00469A4C,?,?,00443D4C,00000001), ref: 00423BF3
                                                                                          • GetLastError.KERNEL32(00000000,00469A4C,?,?,00443D4C,00000001), ref: 004699F1
                                                                                            • Part of subcall function 00427D54: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,00443D4C,00000000,?,00469A00,00000000,00469A4C), ref: 00427D78
                                                                                            • Part of subcall function 00427D54: LocalFree.KERNEL32(00000001,00427DD1,00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,00443D4C,00000000,?,00469A00,00000000,00469A4C), ref: 00427DC4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CreateFileFormatFreeFullLocalMessageNamePath
                                                                                          • String ID: \UA$dUA
                                                                                          • API String ID: 503893064-3864016770
                                                                                          • Opcode ID: 418976f398992d067874a22c3dfcb2c141b6989754af953b0ea81b962e05c3c9
                                                                                          • Instruction ID: 123e0454fb2a9dec89cd9e8203dbd653fcf04e778e7e37e714b9737e464d7bf3
                                                                                          • Opcode Fuzzy Hash: 418976f398992d067874a22c3dfcb2c141b6989754af953b0ea81b962e05c3c9
                                                                                          • Instruction Fuzzy Hash: 8641A370B002599FDB00EFA6C8815EEBBF5AF58314F40812AE914A7382D77D5E05CB6A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040DE74 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E0040DE74(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x6d1c0c()) {
					_v16 = E0040DE30( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x6d1c08(4,  &_v32,  &_v20);
				}
				_t39 = E0040DE30( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E0040B2DC(_t81, _t67);
					_t39 = L00406F28(_t67);
				}
				if(_v16 != 0) {
					 *0x6d1c08(0, 0,  &_v20);
					_t68 = E0040DE30( &_v12);
					if(_v8 != _v12 || E0040DE0C(_v16, _v12, _t68) != 0) {
						 *0x6d1c08(8, _v16,  &_v20);
					}
					L00406F28(_t68);
					return L00406F28(_v16);
				}
				return _t39;
			}





















                                                                                          0x0040de7c
                                                                                          0x0040de7e
                                                                                          0x0040de82
                                                                                          0x0040de8e
                                                                                          0x0040de98
                                                                                          0x0040de9b
                                                                                          0x0040de9d
                                                                                          0x0040dea4
                                                                                          0x0040dea7
                                                                                          0x0040deb8
                                                                                          0x0040debe
                                                                                          0x0040dec1
                                                                                          0x0040dec4
                                                                                          0x0040dec7
                                                                                          0x0040decd
                                                                                          0x0040ded3
                                                                                          0x0040dee3
                                                                                          0x0040dee3
                                                                                          0x0040deec
                                                                                          0x0040def1
                                                                                          0x0040def5
                                                                                          0x0040defa
                                                                                          0x0040deff
                                                                                          0x0040df01
                                                                                          0x0040df02
                                                                                          0x0040df09
                                                                                          0x0040df11
                                                                                          0x0040df16
                                                                                          0x0040df16
                                                                                          0x0040df1c
                                                                                          0x0040df1f
                                                                                          0x0040df1f
                                                                                          0x0040df09
                                                                                          0x0040df26
                                                                                          0x0040df2d
                                                                                          0x0040df2d
                                                                                          0x0040df36
                                                                                          0x0040df40
                                                                                          0x0040df4e
                                                                                          0x0040df56
                                                                                          0x0040df73
                                                                                          0x0040df73
                                                                                          0x0040df7b
                                                                                          0x00000000
                                                                                          0x0040df83
                                                                                          0x0040df8d

                                                                                          APIs
                                                                                          • GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040DE85
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040DEE3
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040DF40
                                                                                          • SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040DF73
                                                                                            • Part of subcall function 0040DE30: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040DEF1), ref: 0040DE47
                                                                                            • Part of subcall function 0040DE30: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040DEF1), ref: 0040DE64
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$LanguagesPreferred$Language
                                                                                          • String ID:
                                                                                          • API String ID: 2255706666-0
                                                                                          • Opcode ID: b47dba57b8259bcf0e57d96a65ad17d56eda33f70e7b1fcc165f5d6ac375021f
                                                                                          • Instruction ID: 69b1dabfcf83cd92044bbbe7d095353c7cd2b80021ffbfb9d1b785f1729ac455
                                                                                          • Opcode Fuzzy Hash: b47dba57b8259bcf0e57d96a65ad17d56eda33f70e7b1fcc165f5d6ac375021f
                                                                                          • Instruction Fuzzy Hash: 63317070E1021A9BCB10DFE9D884AAEB7B5FF14305F40417AE516FB2D1D7789A09CB94
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005CE374 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E005CE374(intOrPtr* __eax, int __ecx, int __edx, int _a4, int _a8) {
				int _v8;
				int _v12;
				int _t31;
				intOrPtr* _t41;
				int _t54;
				int _t55;

				_v8 = __ecx;
				_t54 = __edx;
				_t41 = __eax;
				MulDiv( *(__eax + 0x50), __edx, _v8);
				_v12 = MulDiv( *(_t41 + 0x54), _a8, _a4);
				if(( *(_t41 + 0x61) & 0x00000001) != 0) {
					_t55 =  *(_t41 + 0x58);
				} else {
					_t55 = MulDiv( *(_t41 + 0x58), _t54, _v8);
				}
				if(( *(_t41 + 0x61) & 0x00000002) != 0) {
					_t31 =  *(_t41 + 0x5c);
				} else {
					_t31 = MulDiv( *(_t41 + 0x5c), _a8, _a4);
				}
				return  *((intOrPtr*)( *_t41 + 0xc8))(_t31, _t55);
			}









                                                                                          0x005ce37d
                                                                                          0x005ce380
                                                                                          0x005ce382
                                                                                          0x005ce38d
                                                                                          0x005ce3a5
                                                                                          0x005ce3ac
                                                                                          0x005ce3c0
                                                                                          0x005ce3ae
                                                                                          0x005ce3bc
                                                                                          0x005ce3bc
                                                                                          0x005ce3c7
                                                                                          0x005ce3dc
                                                                                          0x005ce3c9
                                                                                          0x005ce3d5
                                                                                          0x005ce3d5
                                                                                          0x005ce3f6

                                                                                          APIs
                                                                                          • MulDiv.KERNEL32(?,0068D5D0,?), ref: 005CE38D
                                                                                          • MulDiv.KERNEL32(?,005CE4BF,0068D5D0), ref: 005CE3A0
                                                                                          • MulDiv.KERNEL32(?,0068D5D0,?), ref: 005CE3B7
                                                                                          • MulDiv.KERNEL32(?,005CE4BF,0068D5D0), ref: 005CE3D5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ac23038dacf6796b57d110ed30358184083c47a134689276074c101833fe842e
                                                                                          • Instruction ID: 3e71b6adc286f200af4aaafaaf3a8fca573aba72415269075ac824ff0f327e96
                                                                                          • Opcode Fuzzy Hash: ac23038dacf6796b57d110ed30358184083c47a134689276074c101833fe842e
                                                                                          • Instruction Fuzzy Hash: B9113072A04244AFCB44DEDDD8C5E9F7BEDEF48364B144499F908DB242C678ED808BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004F53AC Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 67%
                                                                                          			E004F53AC(intOrPtr* __eax, struct HICON__* __edx, void* __eflags) {
				intOrPtr* _v8;
				struct _ICONINFO _v28;
				intOrPtr _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr _t33;
				intOrPtr _t45;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t49 = _t51;
				_t52 = _t51 + 0xffffffd0;
				_v8 = __eax;
				E004F5338(_v8, __edx);
				if(__edx == 0 || GetIconInfo(__edx,  &_v28) == 0) {
					return  *((intOrPtr*)( *_v8 + 0x10))();
				} else {
					_push(_t49);
					_push(0x4f5429);
					_push( *[fs:edx]);
					 *[fs:edx] = _t52;
					if(GetObjectW(_v28.hbmColor, 0x18,  &_v52) != 0) {
						_t33 =  *((intOrPtr*)(_v8 + 0x28));
						 *((intOrPtr*)(_t33 + 0xc)) = _v48;
						 *((intOrPtr*)(_t33 + 0x10)) = _v44;
					}
					_pop(_t45);
					 *[fs:eax] = _t45;
					_push(E004F5430);
					DeleteObject(_v28.hbmMask);
					return DeleteObject(_v28.hbmColor);
				}
			}













                                                                                          0x004f53ad
                                                                                          0x004f53af
                                                                                          0x004f53b5
                                                                                          0x004f53bf
                                                                                          0x004f53c6
                                                                                          0x004f543f
                                                                                          0x004f53d6
                                                                                          0x004f53d8
                                                                                          0x004f53d9
                                                                                          0x004f53de
                                                                                          0x004f53e1
                                                                                          0x004f53f5
                                                                                          0x004f53fa
                                                                                          0x004f5400
                                                                                          0x004f5406
                                                                                          0x004f5406
                                                                                          0x004f540b
                                                                                          0x004f540e
                                                                                          0x004f5411
                                                                                          0x004f541a
                                                                                          0x004f5428
                                                                                          0x004f5428

                                                                                          APIs
                                                                                          • GetIconInfo.USER32(00000000,00000000), ref: 004F53CD
                                                                                          • GetObjectW.GDI32(0068D5D0,00000018,00000000,00000000,004F5429,?,004C0068), ref: 004F53EE
                                                                                          • DeleteObject.GDI32(?), ref: 004F541A
                                                                                          • DeleteObject.GDI32(0068D5D0), ref: 004F5423
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$Delete$IconInfo
                                                                                          • String ID:
                                                                                          • API String ID: 507670407-0
                                                                                          • Opcode ID: 939d8cbd648baad16ebc5502745bc899ef72b4fd7c693fad9428492138ac7e12
                                                                                          • Instruction ID: 4322d414b200eb17045e09ec041732102b9da4c87ad94fc4c4d540c0fc3291bf
                                                                                          • Opcode Fuzzy Hash: 939d8cbd648baad16ebc5502745bc899ef72b4fd7c693fad9428492138ac7e12
                                                                                          • Instruction Fuzzy Hash: 2B11A375A00608AFCB04DFA6D981DAEB7F9EF88314B5081AAFE04D3351DB38DE408B54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005B9590 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 93%
                                                                                          			E005B9590(signed char __eax, intOrPtr _a4) {
				int _t22;
				void* _t23;
				int _t31;
				signed int _t35;
				signed char _t38;
				void* _t43;
				void* _t44;

				_t38 = __eax;
				_t2 = _a4 - 4; // 0xc31852ff
				_t22 = IsWindowVisible( *( *_t2 + 0x188));
				asm("sbb eax, eax");
				_t23 = _t22 + 1;
				_t43 = _t23 -  *0x6cccd4; // 0x0
				if(_t43 == 0) {
					_t44 = _t38 -  *0x6cccd4; // 0x0
					if(_t44 != 0) {
						_t5 = _a4 - 4; // 0xc31852ff
						if( *((char*)( *_t5 + 0xeb)) != 0 &&  *0x6cccd4 == 0) {
							_t8 = _a4 - 4; // 0xc31852ff
							_t35 = GetWindowLongW( *( *_t8 + 0x188), 0xffffffec);
							_t11 = _a4 - 4; // 0xc31852ff
							SetWindowLongW( *( *_t11 + 0x188), 0xffffffec, _t35 | 0x08000000);
						}
						_t16 = _a4 - 4; // 0xc31852ff
						_t31 = SetWindowPos( *( *_t16 + 0x188), 0, 0, 0, 0, 0,  *(0x6cccd6 + (_t38 & 0x000000ff) * 2) & 0x0000ffff);
						 *0x6cccd4 = _t38;
						return _t31;
					}
				}
				return _t23;
			}










                                                                                          0x005b9594
                                                                                          0x005b9599
                                                                                          0x005b95a3
                                                                                          0x005b95ab
                                                                                          0x005b95ad
                                                                                          0x005b95ae
                                                                                          0x005b95b4
                                                                                          0x005b95b6
                                                                                          0x005b95bc
                                                                                          0x005b95c1
                                                                                          0x005b95cb
                                                                                          0x005b95d9
                                                                                          0x005b95e5
                                                                                          0x005b95ed
                                                                                          0x005b95ff
                                                                                          0x005b95ff
                                                                                          0x005b961d
                                                                                          0x005b9627
                                                                                          0x005b962c
                                                                                          0x00000000
                                                                                          0x005b962c
                                                                                          0x005b95bc
                                                                                          0x005b9634

                                                                                          APIs
                                                                                          • IsWindowVisible.USER32(?), ref: 005B95A3
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 005B95E5
                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 005B95FF
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,024C4910,?,005B96B9,?,?,?,024C4910), ref: 005B9627
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Long$Visible
                                                                                          • String ID:
                                                                                          • API String ID: 2967648141-0
                                                                                          • Opcode ID: 842486b8e95f12e4d0d419cdbe77ed65285d8059c807cbf751cb688483714887
                                                                                          • Instruction ID: de5a40ccb5800a4cef2b87037ee72a09c9fd5293aebedbf233be07227e7c069f
                                                                                          • Opcode Fuzzy Hash: 842486b8e95f12e4d0d419cdbe77ed65285d8059c807cbf751cb688483714887
                                                                                          • Instruction Fuzzy Hash: B31161742851446FDB00DB28D888FFA7FE9AB45324F458191F988CB362CA38ED80CB54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0046A218 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 80%
                                                                                          			E0046A218(void* __eax, struct HINSTANCE__* __edx, WCHAR* _a8) {
				WCHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				WCHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t29 = FindResourceW(__edx, _v8, _a8);
				 *(_t23 + 0x10) = _t29;
				if(_t29 == 0) {
					E0046A178(_t23, _t24, _t29, _t31, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x46a2b4
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				if(_t30 == 0) {
					E0046A178(_t23, _t24, _t30, _t31, _t32);
				}
				_t7 = _t23 + 0x10; // 0x46a2b4
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x469b00
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E00469AAC(_t23, _t25, _t18);
			}

















                                                                                          0x0046a21f
                                                                                          0x0046a222
                                                                                          0x0046a224
                                                                                          0x0046a234
                                                                                          0x0046a236
                                                                                          0x0046a23b
                                                                                          0x0046a23e
                                                                                          0x0046a243
                                                                                          0x0046a243
                                                                                          0x0046a244
                                                                                          0x0046a24e
                                                                                          0x0046a250
                                                                                          0x0046a255
                                                                                          0x0046a258
                                                                                          0x0046a25d
                                                                                          0x0046a25e
                                                                                          0x0046a268
                                                                                          0x0046a269
                                                                                          0x0046a26d
                                                                                          0x0046a276
                                                                                          0x0046a281

                                                                                          APIs
                                                                                          • FindResourceW.KERNEL32(00400000,?,?,00444A50,00400000,00000001,00000000,?,0046A15A,00000000,00000000,?,006D579C,?,?,006AC890), ref: 0046A22F
                                                                                          • LoadResource.KERNEL32(00400000,0046A2B4,00400000,?,?,00444A50,00400000,00000001,00000000,?,0046A15A,00000000,00000000,?,006D579C,?), ref: 0046A249
                                                                                          • SizeofResource.KERNEL32(00400000,0046A2B4,00400000,0046A2B4,00400000,?,?,00444A50,00400000,00000001,00000000,?,0046A15A,00000000,00000000), ref: 0046A263
                                                                                          • LockResource.KERNEL32(00469B00,00000000,00400000,0046A2B4,00400000,0046A2B4,00400000,?,?,00444A50,00400000,00000001,00000000,?,0046A15A,00000000), ref: 0046A26D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadLockSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 3473537107-0
                                                                                          • Opcode ID: c0a3742649e4821bf1d8e39dd4131d6b260b263a11f53cd498264533ba18d33a
                                                                                          • Instruction ID: abb9b97bb193dfeb05d9d82a7f41705a61c143c3b7d9841fcbe573c2d8062a85
                                                                                          • Opcode Fuzzy Hash: c0a3742649e4821bf1d8e39dd4131d6b260b263a11f53cd498264533ba18d33a
                                                                                          • Instruction Fuzzy Hash: C4F081B36406046F5745EE9DA881DAB77ECEE89364310015FF908D7302EA39DD51477A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00610040 Relevance: 6.0, APIs: 4, Instructions: 48registrywindowCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 90%
                                                                                          			E00610040(void* __eax, void* __ecx, void* __edx) {
				void* _v16;
				int _t13;
				void* _t20;
				void* _t26;
				void* _t27;

				_push(__ecx);
				_t27 = __edx;
				_t26 = __eax;
				if(__ecx == 0) {
					_t20 = 0x80000002;
				} else {
					_t20 = 0x80000001;
				}
				if(E005C7A14(0,  *((intOrPtr*)(0x6ccfc0 + (E005C77E8() & 0x0000007f) * 4)), _t20,  &_v16, 2, 0) == 0) {
					RegDeleteValueW(_v16, E0040B278(_t26));
					RegCloseKey(_v16);
				}
				_t13 = RemoveFontResourceW(E0040B278(_t27));
				if(_t13 != 0) {
					_t13 = SendNotifyMessageW(0xffff, 0x1d, 0, 0);
				}
				return _t13;
			}








                                                                                          0x00610043
                                                                                          0x00610044
                                                                                          0x00610046
                                                                                          0x0061004a
                                                                                          0x00610053
                                                                                          0x0061004c
                                                                                          0x0061004c
                                                                                          0x0061004c
                                                                                          0x0061007b
                                                                                          0x0061008a
                                                                                          0x00610093
                                                                                          0x00610093
                                                                                          0x006100a0
                                                                                          0x006100a7
                                                                                          0x006100b4
                                                                                          0x006100b4
                                                                                          0x006100bd

                                                                                          APIs
                                                                                          • RegDeleteValueW.ADVAPI32(?,00000000,?,00000002,00000000,?,?,?,?,0062AC8F), ref: 0061008A
                                                                                          • RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,?,?,0062AC8F), ref: 00610093
                                                                                          • RemoveFontResourceW.GDI32(00000000), ref: 006100A0
                                                                                          • SendNotifyMessageW.USER32(0000FFFF,0000001D,00000000,00000000), ref: 006100B4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseDeleteFontMessageNotifyRemoveResourceSendValue
                                                                                          • String ID:
                                                                                          • API String ID: 261542597-0
                                                                                          • Opcode ID: 6352ecd0dff5975f54d4dfb99d8f1d3b9856d6650d5dea7abd64c14d2d8d7be5
                                                                                          • Instruction ID: 1dce9f2b70afa6587215b720e4c7b57155893329b24cac9d33cbe1fd09ddcff8
                                                                                          • Opcode Fuzzy Hash: 6352ecd0dff5975f54d4dfb99d8f1d3b9856d6650d5dea7abd64c14d2d8d7be5
                                                                                          • Instruction Fuzzy Hash: B2F0C87674430567EA20B6B65C4BFEF128E8FC9745F24492EBA04EB282D668DC814369
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0050E958 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 87%
                                                                                          			E0050E958(struct HWND__* __eax, void* __ecx) {
				intOrPtr _t5;
				struct HWND__* _t12;
				void* _t15;
				DWORD* _t16;

				_t13 = __ecx;
				_push(__ecx);
				_t12 = __eax;
				_t15 = 0;
				if(__eax != 0 && GetWindowThreadProcessId(__eax, _t16) != 0 && GetCurrentProcessId() ==  *_t16) {
					_t5 =  *0x6d5648; // 0x2506894
					if(GlobalFindAtomW(E0040B278(_t5)) !=  *0x6d5642) {
						_t15 = E0050E924(_t12, _t13);
					} else {
						_t15 = GetPropW(_t12,  *0x6d5642 & 0x0000ffff);
					}
				}
				return _t15;
			}







                                                                                          0x0050e958
                                                                                          0x0050e95a
                                                                                          0x0050e95b
                                                                                          0x0050e95d
                                                                                          0x0050e961
                                                                                          0x0050e978
                                                                                          0x0050e98f
                                                                                          0x0050e9aa
                                                                                          0x0050e991
                                                                                          0x0050e99f
                                                                                          0x0050e99f
                                                                                          0x0050e98f
                                                                                          0x0050e9b1

                                                                                          APIs
                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 0050E965
                                                                                          • GetCurrentProcessId.KERNEL32(?,024CBDE0,00000000,005BA39A,?,?,024CBDE0,00000001,005B8697,?,00000000,00000000,00000000,00000000), ref: 0050E96E
                                                                                          • GlobalFindAtomW.KERNEL32(00000000), ref: 0050E983
                                                                                          • GetPropW.USER32(00000000,00000000), ref: 0050E99A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Process$AtomCurrentFindGlobalPropThreadWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2582817389-0
                                                                                          • Opcode ID: be0aff2e294fe32d3c3e4bd4292d022a37ec9b22ed0a2b8a76d9bf3c2886288f
                                                                                          • Instruction ID: 299b27e64c01e87a133ce8a54c99347aef86e5c58dac0e1e1101b5cceb09c5b5
                                                                                          • Opcode Fuzzy Hash: be0aff2e294fe32d3c3e4bd4292d022a37ec9b22ed0a2b8a76d9bf3c2886288f
                                                                                          • Instruction Fuzzy Hash: 09F0ECA160511166CB60BBB65C8787F5A8C9FC43907751D2BF841DA192D514CC8142FE
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006ACABC Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E006ACABC(signed char __eax, void* __ecx, void* __edx, void* __eflags) {
				long _t7;
				void* _t9;
				void* _t14;
				void* _t15;
				signed char* _t16;

				_t17 = __eflags;
				_push(__ecx);
				_t14 = __ecx;
				_t15 = __edx;
				 *_t16 = __eax;
				while(1) {
					E0060C158( *_t16 & 0x000000ff, _t15, _t17);
					asm("sbb ebx, ebx");
					_t9 = _t9 + 1;
					if(_t9 != 0 || GetLastError() == 2 || GetLastError() == 3) {
						break;
					}
					_t7 = GetTickCount();
					_t17 = _t7 - _t14 - 0x7d0;
					if(_t7 - _t14 < 0x7d0) {
						Sleep(0x32);
						continue;
					}
					break;
				}
				return _t9;
			}








                                                                                          0x006acabc
                                                                                          0x006acabf
                                                                                          0x006acac0
                                                                                          0x006acac2
                                                                                          0x006acac4
                                                                                          0x006acac7
                                                                                          0x006acacd
                                                                                          0x006acad5
                                                                                          0x006acad7
                                                                                          0x006acada
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x006acaf0
                                                                                          0x006acaf7
                                                                                          0x006acafc
                                                                                          0x006acb00
                                                                                          0x00000000
                                                                                          0x006acb00
                                                                                          0x00000000
                                                                                          0x006acafc
                                                                                          0x006acb0d

                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CountSleepTick
                                                                                          • String ID:
                                                                                          • API String ID: 2227064392-0
                                                                                          • Opcode ID: ee74c39121b769257f7a891946ff07eff549841ac899c56840c70f6bc80b8cbc
                                                                                          • Instruction ID: 650aecd8dda8324acb9ef1ef12543e615cdaddf0aa48ac4ca6bdf88ba774c7be
                                                                                          • Opcode Fuzzy Hash: ee74c39121b769257f7a891946ff07eff549841ac899c56840c70f6bc80b8cbc
                                                                                          • Instruction Fuzzy Hash: 2AE02B7234838094D725356E58864BE8D5ACFC3376F280A3FF0C4D2182C4058D85C576
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006A5D88 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E006A5D88() {
				long _v8;
				void _v12;
				void* _v16;
				void* _t16;
				HANDLE* _t17;

				_t17 =  &_v12;
				_t16 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 8, _t17) != 0) {
					_v12 = 0;
					if(GetTokenInformation(_v16, 0x12,  &_v12, 4,  &_v8) != 0) {
						_t16 = _v16;
					}
					CloseHandle( *_t17);
				}
				return _t16;
			}








                                                                                          0x006a5d89
                                                                                          0x006a5d8c
                                                                                          0x006a5d9e
                                                                                          0x006a5da2
                                                                                          0x006a5dc0
                                                                                          0x006a5dc2
                                                                                          0x006a5dc2
                                                                                          0x006a5dca
                                                                                          0x006a5dca
                                                                                          0x006a5dd5

                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000008), ref: 006A5D91
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000008), ref: 006A5D97
                                                                                          • GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 006A5DB9
                                                                                          • CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 006A5DCA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$CloseCurrentHandleInformationOpen
                                                                                          • String ID:
                                                                                          • API String ID: 215268677-0
                                                                                          • Opcode ID: afea7f4269af62d161ed65023b08510fb3f5f5d3f19be2d10221e2fcac776304
                                                                                          • Instruction ID: 606920211f29873d44d72264013709cf63daaae85b794eef22724c21b877f5a5
                                                                                          • Opcode Fuzzy Hash: afea7f4269af62d161ed65023b08510fb3f5f5d3f19be2d10221e2fcac776304
                                                                                          • Instruction Fuzzy Hash: 30F030716043017BD700EAB58D82EDB77DCAF45715F00482DBA98C7281DA38ED489766
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004F5548 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004F5548() {
				signed char _v28;
				void* _t4;
				signed int _t8;
				struct HDC__* _t9;
				struct tagTEXTMETRICW* _t10;

				_t8 = 1;
				_t9 = GetDC(0);
				if(_t9 != 0) {
					_t4 =  *0x6d54b0; // 0x58a00b4
					if(SelectObject(_t9, _t4) != 0 && GetTextMetricsW(_t9, _t10) != 0) {
						_t8 = _v28 & 0x000000ff;
					}
					ReleaseDC(0, _t9);
				}
				return _t8;
			}








                                                                                          0x004f554d
                                                                                          0x004f5556
                                                                                          0x004f555a
                                                                                          0x004f555c
                                                                                          0x004f556a
                                                                                          0x004f5577
                                                                                          0x004f5577
                                                                                          0x004f557f
                                                                                          0x004f557f
                                                                                          0x004f558b

                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 004F5551
                                                                                          • SelectObject.GDI32(00000000,058A00B4), ref: 004F5563
                                                                                          • GetTextMetricsW.GDI32(00000000,?,00000000,058A00B4,00000000), ref: 004F556E
                                                                                          • ReleaseDC.USER32 ref: 004F557F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsObjectReleaseSelectText
                                                                                          • String ID:
                                                                                          • API String ID: 2013942131-0
                                                                                          • Opcode ID: 7f08a457e74fbd3b271c5bbe40b56a30871c5d5dda21d4d00258fc544de77888
                                                                                          • Instruction ID: eb0f3ac5e6ff13c2d338f041733c2278b611cd6d279531a3f0c2a93b6799ed89
                                                                                          • Opcode Fuzzy Hash: 7f08a457e74fbd3b271c5bbe40b56a30871c5d5dda21d4d00258fc544de77888
                                                                                          • Instruction Fuzzy Hash: 64E0DF71E029A432D61071661C82BEF2A498F823AAF08112BFF08992D1DA0CC94083FE
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0060F338 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 78%
                                                                                          			E0060F338(void* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4, void* _a8, intOrPtr _a12, signed char _a16, char _a20) {
				intOrPtr _v8;
				struct _SHELLEXECUTEINFOW _v68;
				void* _t52;
				intOrPtr _t61;
				void* _t65;
				intOrPtr* _t67;
				void* _t70;

				_v8 = __ecx;
				_t65 = __edx;
				_t52 = __eax;
				_t67 = _a4;
				E0040A2AC(_a20);
				_push(_t70);
				_push(0x60f41c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70 + 0xffffffc0;
				if(_a20 == 0) {
					E005C5378(_t65, __ecx,  &_a20);
					if(_a20 == 0) {
						E005C745C( &_a20);
					}
				}
				E00407760( &_v68, 0x3c);
				_v68.cbSize = 0x3c;
				_v68.fMask = 0x540;
				if(_t52 != 0) {
					_v68.lpVerb = E0040B278(_t52);
				}
				_v68.lpFile = E0040B278(_t65);
				_v68.lpParameters = E0040B278(_v8);
				_v68.lpDirectory = E0040B278(_a20);
				_v68.nShow = _a12;
				ShellExecuteExW( &_v68);
				asm("sbb ebx, ebx");
				_t53 = _t52 + 1;
				if(_t52 + 1 != 0) {
					 *_t67 = 0x103;
					_t39 = _v68.hProcess;
					if(_v68.hProcess != 0) {
						E0060EFD8(_t39, _t53, _a16 & 0x000000ff, _t65, _t67, _t67);
					}
				} else {
					 *_t67 = GetLastError();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E0060F423);
				return E0040A1C8( &_a20);
			}










                                                                                          0x0060f341
                                                                                          0x0060f344
                                                                                          0x0060f346
                                                                                          0x0060f348
                                                                                          0x0060f34e
                                                                                          0x0060f355
                                                                                          0x0060f356
                                                                                          0x0060f35b
                                                                                          0x0060f35e
                                                                                          0x0060f365
                                                                                          0x0060f36c
                                                                                          0x0060f375
                                                                                          0x0060f37a
                                                                                          0x0060f37a
                                                                                          0x0060f375
                                                                                          0x0060f389
                                                                                          0x0060f38e
                                                                                          0x0060f395
                                                                                          0x0060f39e
                                                                                          0x0060f3a7
                                                                                          0x0060f3a7
                                                                                          0x0060f3b1
                                                                                          0x0060f3bc
                                                                                          0x0060f3c7
                                                                                          0x0060f3cd
                                                                                          0x0060f3d4
                                                                                          0x0060f3dc
                                                                                          0x0060f3de
                                                                                          0x0060f3e1
                                                                                          0x0060f3ec
                                                                                          0x0060f3f2
                                                                                          0x0060f3f7
                                                                                          0x0060f401
                                                                                          0x0060f401
                                                                                          0x0060f3e3
                                                                                          0x0060f3e8
                                                                                          0x0060f3e8
                                                                                          0x0060f408
                                                                                          0x0060f40b
                                                                                          0x0060f40e
                                                                                          0x0060f41b

                                                                                          APIs
                                                                                          • ShellExecuteExW.SHELL32(0000003C), ref: 0060F3D4
                                                                                          • GetLastError.KERNEL32(00000000,0060F41C,?,?,?,00000001), ref: 0060F3E3
                                                                                            • Part of subcall function 005C745C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C746F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: DirectoryErrorExecuteLastShellSystem
                                                                                          • String ID: <
                                                                                          • API String ID: 893404051-4251816714
                                                                                          • Opcode ID: a1cf411bc80e7aee9040c3d6da38753e39eae65efdb4a5efada5b8c5d9cd2cca
                                                                                          • Instruction ID: dcf8102ceadd4487f49ba87b12be971fda6b0883f73445cbcbdd13ac2b4765a0
                                                                                          • Opcode Fuzzy Hash: a1cf411bc80e7aee9040c3d6da38753e39eae65efdb4a5efada5b8c5d9cd2cca
                                                                                          • Instruction Fuzzy Hash: 6C216D70A40209DFDB24EFA5C885ADE7BE9EF58394F50003AF800E7691E77899518B98
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B72C2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 72%
                                                                                          			E006B72C2(void* __ecx, void* __esi, void* __fp0) {
				void* _t21;
				intOrPtr* _t27;
				intOrPtr* _t33;
				void* _t41;
				intOrPtr _t43;
				char _t46;
				void* _t47;
				intOrPtr _t55;
				intOrPtr _t59;
				void* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t67;

				_t67 = __fp0;
				_t60 = __esi;
				_t47 = __ecx;
				if(( *(_t61 - 9) & 0x00000001) != 0) {
					L3:
					_t46 = 1;
				} else {
					_t64 =  *(_t61 - 9) & 0x00000040;
					if(( *(_t61 - 9) & 0x00000040) != 0) {
						goto L3;
					} else {
						_t46 = 0;
					}
				}
				_t21 = E006A5DD8(_t46, _t47, 0, _t64, _t67);
				_t65 = _t21;
				if(_t21 != 0) {
					_t27 =  *0x6cdec4; // 0x6d579c
					SetWindowPos( *( *_t27 + 0x188), 0, 0, 0, 0, 0, 0x97);
					_push(_t61);
					_push(0x6b736d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t62;
					_t33 =  *0x6cdec4; // 0x6d579c
					 *((intOrPtr*)(_t61 - 0x18)) =  *((intOrPtr*)( *_t33 + 0x188));
					 *((char*)(_t61 - 0x14)) = 0;
					E004244F8(L"/INITPROCWND=$%x ", 0, _t61 - 0x18, _t61 - 0x10);
					_push(_t61 - 0x10);
					E005C6E90(_t61 - 0x1c, _t46, _t60, _t65);
					_pop(_t41);
					E0040B470(_t41,  *((intOrPtr*)(_t61 - 0x1c)));
					_t43 =  *0x6d68d0; // 0x0
					E006A60E8(_t43, _t46, 0x6cd884,  *((intOrPtr*)(_t61 - 0x10)), _t60, _t65, _t67);
					_pop(_t59);
					 *[fs:eax] = _t59;
					 *((char*)(_t61 - 1)) = 1;
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E006B73CE);
				E0040A1C8(_t61 - 0x1c);
				return E0040A1C8(_t61 - 0x10);
			}
















                                                                                          0x006b72c2
                                                                                          0x006b72c2
                                                                                          0x006b72c2
                                                                                          0x006b72c6
                                                                                          0x006b72d2
                                                                                          0x006b72d2
                                                                                          0x006b72c8
                                                                                          0x006b72c8
                                                                                          0x006b72cc
                                                                                          0x00000000
                                                                                          0x006b72ce
                                                                                          0x006b72ce
                                                                                          0x006b72ce
                                                                                          0x006b72cc
                                                                                          0x006b72d8
                                                                                          0x006b72dd
                                                                                          0x006b72df
                                                                                          0x006b72f4
                                                                                          0x006b7302
                                                                                          0x006b7309
                                                                                          0x006b730a
                                                                                          0x006b730f
                                                                                          0x006b7312
                                                                                          0x006b7319
                                                                                          0x006b7326
                                                                                          0x006b7329
                                                                                          0x006b7337
                                                                                          0x006b733f
                                                                                          0x006b7343
                                                                                          0x006b734b
                                                                                          0x006b734c
                                                                                          0x006b7359
                                                                                          0x006b735e
                                                                                          0x006b7365
                                                                                          0x006b7368
                                                                                          0x006b73a5
                                                                                          0x006b73a5
                                                                                          0x006b73ab
                                                                                          0x006b73ae
                                                                                          0x006b73b1
                                                                                          0x006b73b9
                                                                                          0x006b73c6

                                                                                          APIs
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 006B7302
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window
                                                                                          • String ID: /INITPROCWND=$%x $@
                                                                                          • API String ID: 2353593579-4169826103
                                                                                          • Opcode ID: eb30107b56510822b174cf968a4b08beb79f0faad70d447a528a03e3faf130ce
                                                                                          • Instruction ID: aee196482ecc750f80196a5b85e8ce4b28bd470815894a77b79cec9963f5eee4
                                                                                          • Opcode Fuzzy Hash: eb30107b56510822b174cf968a4b08beb79f0faad70d447a528a03e3faf130ce
                                                                                          • Instruction Fuzzy Hash: 0721C070A083489FDB01EBA4D841FEE77F6EF89304F51447AF800E7291DA38AA45DB54
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006ACB10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 68%
                                                                                          			E006ACB10(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char* _t12;
				long _t13;
				void* _t22;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t31;
				void* _t32;
				intOrPtr _t35;

				_t32 = __esi;
				_t31 = __edi;
				_t22 = __ebx;
				_push(0);
				_push(_t35);
				_push(0x6acba2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t35;
				E006255B8(0);
				E006255A4(0);
				if( *0x6d6530 != 0) {
					_t12 =  *0x6cdfdc; // 0x6d62e4
					if( *_t12 != 0) {
						E0061583C(0);
					}
					_t13 = GetTickCount();
					_t29 =  *0x6d6530; // 0x24ae29c
					if(E0060DCC8(0, _t22, 1, _t29, _t13, E006ACABC, 0, 0, 1, 1) == 0) {
						_t26 =  *0x6d6530; // 0x24ae29c
						E0040B4C8( &_v8, _t26, L"Failed to remove temporary directory: ");
						E00616130(_v8, _t22, _t31, _t32);
					}
				}
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E006ACBA9);
				return E0040A1C8( &_v8);
			}













                                                                                          0x006acb10
                                                                                          0x006acb10
                                                                                          0x006acb10
                                                                                          0x006acb13
                                                                                          0x006acb17
                                                                                          0x006acb18
                                                                                          0x006acb1d
                                                                                          0x006acb20
                                                                                          0x006acb25
                                                                                          0x006acb2c
                                                                                          0x006acb38
                                                                                          0x006acb3a
                                                                                          0x006acb42
                                                                                          0x006acb46
                                                                                          0x006acb46
                                                                                          0x006acb58
                                                                                          0x006acb60
                                                                                          0x006acb6f
                                                                                          0x006acb74
                                                                                          0x006acb7f
                                                                                          0x006acb87
                                                                                          0x006acb87
                                                                                          0x006acb6f
                                                                                          0x006acb8e
                                                                                          0x006acb91
                                                                                          0x006acb94
                                                                                          0x006acba1

                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountTick
                                                                                          • String ID: Failed to remove temporary directory: $bm
                                                                                          • API String ID: 536389180-2673898769
                                                                                          • Opcode ID: 3dbcc3c76263f9fdae0a8c57b4196ee31ce737dd9c50e7bdd65a8234f6c725c0
                                                                                          • Instruction ID: 78e05ed3d0f448852bd59dbbb99a4cbd83d81d15065c7e17e95d6b7c04c680f0
                                                                                          • Opcode Fuzzy Hash: 3dbcc3c76263f9fdae0a8c57b4196ee31ce737dd9c50e7bdd65a8234f6c725c0
                                                                                          • Instruction Fuzzy Hash: 9401D430610704AAD751FB75EC47F9A73979B46B10F51046AF500A72D2D7769C40CA28
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00435608 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 66%
                                                                                          			E00435608(signed short* __eax, void* __ebx, void* __edx) {
				signed short* _v8;
				char _v16;
				char _v24;
				void* _t23;
				intOrPtr _t31;
				void* _t32;
				void* _t34;

				_t23 = __edx;
				_v8 = __eax;
				_t2 =  &_v24; // 0x435946
				L0042F03C();
				 *[fs:eax] = _t34 + 0xffffffec;
				_t4 =  &_v24; // 0x435946
				E00430ED4( *((intOrPtr*)( *((intOrPtr*)( *0x6cdffc))))(_v8, 0x400, 0, 8,  *[fs:eax], 0x435674, _t34, _t2, __ebx, _t32), 8,  *_v8 & 0x0000ffff);
				_t6 =  &_v16; // 0x43596b
				E0040A61C(_t23,  *_t6);
				_t31 = _t4;
				 *[fs:eax] = _t31;
				_push(E0043567B);
				_t7 =  &_v24; // 0x435946
				return L00431164(_t7);
			}










                                                                                          0x0043560f
                                                                                          0x00435611
                                                                                          0x00435614
                                                                                          0x00435618
                                                                                          0x00435628
                                                                                          0x00435638
                                                                                          0x0043564f
                                                                                          0x00435656
                                                                                          0x00435659
                                                                                          0x00435660
                                                                                          0x00435663
                                                                                          0x00435666
                                                                                          0x0043566b
                                                                                          0x00435673

                                                                                          APIs
                                                                                          • VariantInit.OLEAUT32(FYC), ref: 00435618
                                                                                            • Part of subcall function 0040A61C: SysReAllocStringLen.OLEAUT32(00000000,?,?), ref: 0040A636
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocInitStringVariant
                                                                                          • String ID: FYC$kYC
                                                                                          • API String ID: 4010818693-1629163012
                                                                                          • Opcode ID: 3b028a09afde62da82f47710d3d6daef9e5d11d6f2f19900e295b27d7684dbff
                                                                                          • Instruction ID: 78d3457c21f8c6ae710edabf1b7f51a26e4fb704544ac86c5ed1d2f79e361521
                                                                                          • Opcode Fuzzy Hash: 3b028a09afde62da82f47710d3d6daef9e5d11d6f2f19900e295b27d7684dbff
                                                                                          • Instruction Fuzzy Hash: 2FF08171704608AFD700EB95CC52E9EB3F8EB4D700FA04176F604E3690DA346E04C769
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B8CAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 73%
                                                                                          			E006B8CAC(void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t1;
				int _t9;
				void* _t12;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				intOrPtr _t20;

				_t15 = __edx;
				if( *0x6d68e5 != 0) {
					E00616130(L"Detected restart. Removing temporary directory.", _t12, _t17, _t18);
					_push(0x6b8ce7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t20;
					E006ACE20();
					E006ACB10(_t12, _t15, _t17, _t18);
					_pop(_t16);
					 *[fs:eax] = _t16;
					E00615560();
					_t9 =  *0x6cd884; // 0x1
					return TerminateProcess(GetCurrentProcess(), _t9);
				}
				return _t1;
			}















                                                                                          0x006b8cac
                                                                                          0x006b8cb9
                                                                                          0x006b8cc0
                                                                                          0x006b8cc8
                                                                                          0x006b8ccd
                                                                                          0x006b8cd0
                                                                                          0x006b8cd3
                                                                                          0x006b8cd8
                                                                                          0x006b8cdf
                                                                                          0x006b8ce2
                                                                                          0x006b8cf6
                                                                                          0x006b8cfb
                                                                                          0x00000000
                                                                                          0x006b8d07
                                                                                          0x006b8d10

                                                                                          APIs
                                                                                            • Part of subcall function 006ACE20: FreeLibrary.KERNEL32(73C00000,006B8CD8,00000000,006B8CE7,?,?,?,?,?,006B97CB), ref: 006ACE36
                                                                                            • Part of subcall function 006ACB10: GetTickCount.KERNEL32 ref: 006ACB58
                                                                                            • Part of subcall function 00615560: SendMessageW.USER32(00000000,00000B01,00000000,00000000), ref: 0061557F
                                                                                          • GetCurrentProcess.KERNEL32(00000001,?,?,?,?,006B97CB), ref: 006B8D01
                                                                                          • TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,006B97CB), ref: 006B8D07
                                                                                          Strings
                                                                                          • Detected restart. Removing temporary directory., xrefs: 006B8CBB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
                                                                                          • String ID: Detected restart. Removing temporary directory.
                                                                                          • API String ID: 1717587489-3199836293
                                                                                          • Opcode ID: 8b6c4944fc7ab40525f7dec581f8ed34f4e4e9e2f9e0182f65f3e4707d23ad92
                                                                                          • Instruction ID: 85aea6856e01ecd59818c985a9c9c54c6fb1bec533a363d5825b66760217dfd7
                                                                                          • Opcode Fuzzy Hash: 8b6c4944fc7ab40525f7dec581f8ed34f4e4e9e2f9e0182f65f3e4707d23ad92
                                                                                          • Instruction Fuzzy Hash: 38E0E5F16082446EE2417BB9FC13DA67F9FDB86764B51043BF50083542D9295C80C338
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C8790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 62%
                                                                                          			E005C8790(void* __eax, void* __edx, void* __eflags) {
				void* __ebx;
				void* __esi;
				void* _t9;
				void* _t11;
				intOrPtr* _t12;
				void* _t14;
				void* _t15;

				_t14 = __edx;
				_t15 = __eax;
				E005C8820(__eax, __eflags);
				_t12 = E00414020(_t11, _t15, GetModuleHandleW(L"user32.dll"), L"ShutdownBlockReasonCreate");
				if(_t12 == 0) {
					__eflags = 0;
					return 0;
				}
				_t9 =  *_t12(_t15, E0040B278(_t14));
				asm("sbb eax, eax");
				return _t9 + 1;
			}










                                                                                          0x005c8793
                                                                                          0x005c8795
                                                                                          0x005c8799
                                                                                          0x005c87b3
                                                                                          0x005c87b7
                                                                                          0x005c87cc
                                                                                          0x00000000
                                                                                          0x005c87cc
                                                                                          0x005c87c2
                                                                                          0x005c87c7
                                                                                          0x00000000

                                                                                          APIs
                                                                                            • Part of subcall function 005C8820: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005C879E,?,?,?,006B7DE9,0000000A,00000002,00000001,00000031,00000000,006B8019), ref: 005C882E
                                                                                          • GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,?,?,006B7DE9,0000000A,00000002,00000001,00000031,00000000,006B8019,?,00000000,006B80E6), ref: 005C87A8
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: HandleModule$AddressProc
                                                                                          • String ID: ShutdownBlockReasonCreate$user32.dll
                                                                                          • API String ID: 1883125708-2866557904
                                                                                          • Opcode ID: a19168e80f619da440fc2a27a922fe76aaadca8270686068a762e6fb9d48a05b
                                                                                          • Instruction ID: 7110eff28424d8e01fad9884693b7150e68d4fec514983f83c6ed3211673b8d3
                                                                                          • Opcode Fuzzy Hash: a19168e80f619da440fc2a27a922fe76aaadca8270686068a762e6fb9d48a05b
                                                                                          • Instruction Fuzzy Hash: E7E0C2623402212E020071FF2C85F7F08CCEDC8B6A3300C3EB200D3501EE5ACC0101AC
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C7488 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 75%
                                                                                          			E005C7488(void* __eax, void* __esi, void* __ebp, void* __eflags) {
				char _v536;
				void* __ebx;
				intOrPtr* _t6;
				void* _t9;
				void* _t15;

				_t9 = __eax;
				E0040A1C8(__eax);
				_t6 = E00414020(_t9, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetSystemWow64DirectoryW");
				if(_t6 != 0) {
					_t6 =  *_t6( &_v536, 0x105);
					if(_t6 > 0 && _t6 < 0x105) {
						return E0040B318(_t9, 0x105, _t15);
					}
				}
				return _t6;
			}








                                                                                          0x005c748f
                                                                                          0x005c7493
                                                                                          0x005c74a8
                                                                                          0x005c74af
                                                                                          0x005c74bb
                                                                                          0x005c74bf
                                                                                          0x00000000
                                                                                          0x005c74d1
                                                                                          0x005c74bf
                                                                                          0x005c74dd

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,0060D678,00000000,0060D74A,?,?,006D579C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C74A2
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                          • API String ID: 1646373207-1816364905
                                                                                          • Opcode ID: dd1ea595911e230b63aaec316c67e30168416ca8f327a292b090e33becaa39e4
                                                                                          • Instruction ID: e1b2a1fbaeccbf4b8658dcbc551e8be6aafa7850fd628b76cf9cecd9236f8401
                                                                                          • Opcode Fuzzy Hash: dd1ea595911e230b63aaec316c67e30168416ca8f327a292b090e33becaa39e4
                                                                                          • Instruction Fuzzy Hash: 95E0DFB07047051BDF1061FA8CC3F9A1D896BDC794F20483E3A90D66C2F9ACD9400AAA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C8644 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 45%
                                                                                          			E005C8644(void* __eax, void* __ecx) {
				void* __ebx;
				void* _t1;
				void* _t4;
				void* _t8;
				intOrPtr* _t9;

				_t1 = __eax;
				_t4 = __eax;
				if( *0x6d57e8 == 0) {
					 *0x6d57ec = E00414020(_t4, _t8, GetModuleHandleW(L"user32.dll"), L"ChangeWindowMessageFilter");
					 *_t9 = 0x6d57e8;
					_t1 = 1;
					asm("lock xchg [edx], eax");
				}
				if( *0x6d57ec != 0) {
					_t1 =  *0x6d57ec(_t4, 1);
				}
				return _t1;
			}








                                                                                          0x005c8644
                                                                                          0x005c8646
                                                                                          0x005c864f
                                                                                          0x005c8666
                                                                                          0x005c866b
                                                                                          0x005c8675
                                                                                          0x005c867a
                                                                                          0x005c867a
                                                                                          0x005c8684
                                                                                          0x005c8689
                                                                                          0x005c8689
                                                                                          0x005c8691

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005C873A,?,00000004,006CCEB4,0061544A,006158C4,00615368,00000000,00000B06,00000000,00000000), ref: 005C865B
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: ChangeWindowMessageFilter$user32.dll
                                                                                          • API String ID: 1646373207-2498399450
                                                                                          • Opcode ID: fef6738620f745ab1874efba3004544ff6482e169155c0e349f99ac77237f17e
                                                                                          • Instruction ID: f5cb7bf2fd8e9c4876a78839223762f9bc4b5f6247b358773db5c5b1cf956787
                                                                                          • Opcode Fuzzy Hash: fef6738620f745ab1874efba3004544ff6482e169155c0e349f99ac77237f17e
                                                                                          • Instruction Fuzzy Hash: 4CE01AB4A01701DED711ABA6AC49FE93BEEE798305F20641EB246D6695CBB904C0CF94
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 005C8820 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 44%
                                                                                          			E005C8820(void* __eax, void* __eflags) {
				void* __ebx;
				void* __esi;
				void* _t7;
				intOrPtr* _t8;
				void* _t9;

				_t9 = __eax;
				_t8 = E00414020(_t7, _t9, GetModuleHandleW(L"user32.dll"), L"ShutdownBlockReasonDestroy");
				if(_t8 == 0) {
					L2:
					return 0;
				} else {
					_push(_t9);
					if( *_t8() != 0) {
						return 1;
					} else {
						goto L2;
					}
				}
			}








                                                                                          0x005c8822
                                                                                          0x005c8839
                                                                                          0x005c883d
                                                                                          0x005c8846
                                                                                          0x005c884a
                                                                                          0x005c883f
                                                                                          0x005c883f
                                                                                          0x005c8844
                                                                                          0x005c884f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x005c8844

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005C879E,?,?,?,006B7DE9,0000000A,00000002,00000001,00000031,00000000,006B8019), ref: 005C882E
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: ShutdownBlockReasonDestroy$user32.dll
                                                                                          • API String ID: 1646373207-260599015
                                                                                          • Opcode ID: 3fbd28814d97db1a372840751324d8c3ac9be682008ec3644daf7441840e1d78
                                                                                          • Instruction ID: f0c74795214b74e90bc607b5066537e4d8d40fa8e1211c6ca3dcb32fdea7855f
                                                                                          • Opcode Fuzzy Hash: 3fbd28814d97db1a372840751324d8c3ac9be682008ec3644daf7441840e1d78
                                                                                          • Instruction Fuzzy Hash: 22D0C7B37117222A651075FA3CE1FF70A8CDD95795354087EF700E2941DD55DC4111A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 006B9800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E006B9800(void* __eflags) {
				intOrPtr* _t2;
				void* _t4;
				void* _t5;

				_t2 = E00414020(_t4, _t5, GetModuleHandleW(L"user32.dll"), L"DisableProcessWindowsGhosting");
				if(_t2 != 0) {
					return  *_t2();
				}
				return _t2;
			}






                                                                                          0x006b9810
                                                                                          0x006b9817
                                                                                          0x00000000
                                                                                          0x006b9819
                                                                                          0x006b981b

                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,006C46BE,00000001,00000000,006C46F1), ref: 006B980A
                                                                                            • Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.509483539.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000007.00000002.509471468.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512093916.00000000006C5000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512125513.00000000006CA000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512144028.00000000006CC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512161630.00000000006CE000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512177339.00000000006CF000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512205118.00000000006D4000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512288329.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512306515.00000000006DB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512318830.00000000006DC000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000007.00000002.512340390.00000000006DE000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_400000_MSDisplay_Windows_V2.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: DisableProcessWindowsGhosting$user32.dll
                                                                                          • API String ID: 1646373207-834958232
                                                                                          • Opcode ID: 1d0e836530d80ee037b6803170de1fe8933ba33f6b77be0c16a5e781bf2d5ad3
                                                                                          • Instruction ID: a737f6cb342469133653c2ad22e7ce718afd724c013acdac2058dbbd1ad6bbf7
                                                                                          • Opcode Fuzzy Hash: 1d0e836530d80ee037b6803170de1fe8933ba33f6b77be0c16a5e781bf2d5ad3
                                                                                          • Instruction Fuzzy Hash: 99B092F0240331101C1072B33C02ACA080A08CBB497024C2A3720A108ADD4880C01239
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%